Hackers Don’t Need Your Password To Run Code On WordPress #wordpress #cybersecurity

Attackers are actively exploiting a flaw in WordPress, and the surprising part is when it happens: during a WordPress core update. While updating, WordPress temporarily creates installation files.

Attackers scan websites looking for those files. If they find an exposed installer, they can send specially crafted requests. These can trick the installer into executing malicious code on the server without ever logging into WordPress.

WordPress fixed the flaw in version 7.1.4, but CISA has now confirmed active exploitation, and Wordfence is recording an increase in attack attempts.

For affected sites, patching may not be enough. Hosting logs and unexpected server changes could reveal whether an earlier update was targeted.