WordPress Core flaw draws nearly 63,000 attack attempts in 24 hours

Threat actors have attempted nearly 63,000 attacks within 24 hours to exploit a high-severity remote code execution vulnerability in WordPress Core shortly after patches were released on 28 October 2026. The WordPress security company Wordfence reported blocking 62,969 attacks targeting the flaw, which impacts WordPress Core versions 4.7 through 7.1.3. Reported by Umut Bayram, the vulnerability carries a CVSS score of 8.1 and does not have a CVE identifier.

The issue occurs because affected versions unpack new files, including the WordPress installer, into a predictable directory under "wp-content/upgrade" during a full-package Core update. Wordfence stated that "predictable, web-accessible staging paths used during full-package core upgrades" allow unauthenticated attackers to execute code on the server during the upgrade window. Alex Thomas, who leads the Wordfence Threat Response Team, said an unauthenticated attacker requesting the installer at precisely the right moment "can interact with the staged WordPress copy and progress to PHP code execution."

Winning the race condition requires a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and adequate time before WordPress cleans up the temporary files. Although the window lasts only seconds in normal lab environments, threat actors are repeatedly polling vulnerable paths such as "setup-config.php". Thomas noted that two of the largest sources polled small groups of sites for roughly 14.5 hours to catch the brief upgrade window, while others tested staging-directory and version-name variations.

The flaw was patched in WordPress 7.1.4, a short-cycle security release led by Aaron Jorbin and Nik Tsekouras. The release also fixes multiple stored XSS vulnerabilities, a stored denial of service issue in the Interactivity API, unauthenticated discovery of unpublished customizer changesets, and privileged users reading notes without post edit access, alongside an update to bundled root certificates due to the eMudhra revocation.

WordPress site owners are advised to update to version 7.1.4 immediately and look for suspicious requests to PHP files under "wp-content/upgrade", as well as unfamiliar administrator accounts, plugins, or PHP files. Security fixes are also being backported to eligible branches through version 4.7, while the next major release, WordPress 7.2, is planned for 8 December.

Sources: The Hacker News, WordPress.org

Written with AI and fact-checked against the linked sources by an automated AI review before publication. Spotted an error? See our Corrections Policy.