Attackers Capitalizing on Unpatched WordPress Sites
Attackers didn’t wait long to capitalize on laggards slow in updating their WordPress sites to patch a critical content injection vulnerability addressed in WordPress 4.7.2.
The update was made public on Jan. 26 with WordPress disclosing six days later that the update also included a silent fix for an unauthenticated privilege escalation flaw in a REST API endpoint.
Researchers as Sucuri, who privately disclosed the vulnerability to WordPress, today said they’ve seen four different campaigns targeting sites still not patched. WordPress includes a default feature that automatically updates sites, but some users choose to disable this feature and test updates before they’re pushed to critical sites running on the platform.
