Discussion
RE: https://infosec.exchange/@ifin/116941087829918408
The patch diffs are clear enough that I expect exploitation of this to start rather quickly. CVEs don't have PoC details, but there's enough there for the beginning of exploit dev, especially with ✨assistance✨.
@mttaggart been doing incident response for two hours now and I'm pretty sure it was being exploited when you were writing this. I'll try to post some details when I have them.
@tehfishman Thanks! Please consider posting to the @ifin thread as well!
@mttaggart @ifin will do if I have anything interesting to share. Haven't fully confirmed exploitation yet but it sure doesn't look good
@mttaggart @ifin due to a comedy of errors, we actually didn't get exploited. The clown show that is higher ed departments being permitted to run their own WordPress servers resulted in running versions so old that they were not vulnerable, and the two instances that went down this morning went down because they fell over in the stiff wind created when our ops team rebooted the servers for standard patching.
Aaand there it is. Confirmed EITW.
@mttaggart There goes the weekend.
Install bonfire.cafe
Get the full app experience
