Hackers Exploited a Critical WordPress Flaw Within Hours of the Patch
Attackers began probing a critical WordPress flaw within hours of its 22 September fix. It can let an attacker run code without logging in, but only under certain conditions.
How the Attack Works
The flaw sits in get_page_template(), the function that picks which template file shows a page. An unauthenticated attacker can make it load a readable PHP file from outside the active theme’s folders.
Two conditions have to be met:
- The active theme must contain a top-level folder whose name starts with “page-”.
- The server must also hold a PHP file the attacker can use. In the attacks so far, that file is
pearcmd.php, part of the PHP package manager PEAR.
After probing WordPress core files, attackers checked for pearcmd.php in three common locations, according to Patchstack. They then used it to write files into the server’s /tmp and /var/tmp folders. Traffic then climbed steadily, peaking around midday UTC on 23 September at more than ten times the volume of the first evening.
Auto-Updates Limit the Damage
Security company Previdian recorded 68 exploitation attempts, as reported by The Hacker News. Ryan Dewhurst, founder and CEO of Previdian, noted that the conditions make a break-in less likely.
Because WordPress has auto-updates enabled by default, we’re likely to see mass-exploitation attempts, but relatively few actual compromises.
Site owners should update to 7.1.2 or the patched release on their branch. Patchstack also advises blocking ".." sequences in the pagename parameter. Turning off PHP’s register_argc_argv setting breaks the pearcmd step.
A Month of Exploited Flaws
The WordPress bug is the latest in a run of flaws exploited soon after disclosure. Cisco warned this month that hackers were exploiting a maximum-severity ISE flaw. Microsoft’s September update fixed a record 974 flaws, two of them already under attack. Google patched a Chrome V8 flaw used in attacks.