What happened
A critical vulnerability has been identified in WordPress Core, specifically a time-of-check time-of-use (TOCTOU) race condition. This flaw could allow unauthenticated attackers to execute malicious code on affected servers during the window of a full-package core upgrade. The vulnerability stems from predictable, web-accessible staging paths used during the upgrade process, which attackers may exploit to gain control over the server environment. The issue has been actively exploited in the wild, indicating that malicious actors are already taking advantage of this flaw.
Who is affected
Organisations running WordPress Core installations are impacted by this vulnerability. All affected deployments are subject to the risk of unauthenticated code execution during the upgrade process. Given the active exploitation, any organisation that performs core upgrades without proper mitigation measures may be vulnerable to compromise. The severity of this issue necessitates immediate attentiveness from affected entities to the recommended security procedures and mitigations.
Recommended actions
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance on prioritising security updates based on risk.
- Review relevant guidance from CISA’s “Forensics Triage Requirements” and implement appropriate security controls to prevent exploitation during core upgrades.
- Discontinue use of the product if mitigations are unavailable and the vulnerability cannot be effectively addressed.
- Assess internet exposure for each deployment, prioritising those with accessible upgrade paths or that are publicly reachable.
