Attackers target the WordPress core update race condition fixed in 7.1.4

WordPress core update race condition (no CVE yet)

• What: A race condition during WordPress core updates can lead to remote code execution through the temporary installer files that WordPress unpacks during an update.
• Severity: Wordfence rates it High (8.1), noting it is hard to pull off.
• Affected: WordPress 4.7 through 7.1.3.
• Exploitation: Not on CISA's Known Exploited Vulnerabilities list. Wordfence logged more than 18,500 attempts in 21 hours against these temporary files, but has not reported any successful break-ins.
• Fixed in: WordPress 7.1.4.

What to do

1. Update to WordPress 7.1.4.

2. Deny web access to /wp-content/upgrade/ at the web server. A security plugin cannot block this, because the request never reaches WordPress. For Apache 2.4, for example:

   <Directory "/path/to/wordpress/wp-content/upgrade">
       Require all denied
   </Directory>
   

More detail is in Patchstack's write-up and SecurityWeek's report.