A race against the update

Attackers moved within days of a WordPress security fix, trying to exploit a high-severity remote code execution flaw in WordPress Core almost 63,000 times in a single 24-hour period. Security firm Wordfence, which reported the activity on 30 October 2026, said it had blocked 62,969 attacks aimed at the vulnerability. The flaw affects WordPress Core versions 4.7 through 7.1.3, carries a severity score of 8.1, and has no CVE identifier. Patches were released on 28 October 2026, and site owners are advised to update to version 7.1.4 as soon as possible.

How the flaw works

The problem lies in how WordPress handles full-package core upgrades. During an update, new files are unpacked into a predictable staging directory under wp-content/upgrade, and that copy can include the WordPress installer. Because the staging area is web-accessible on many servers, an attacker who requests the installer at exactly the right moment may be able to interact with the staged copy and reach PHP code execution. The window is normally only seconds long in laboratory conditions, but attackers are polling vulnerable paths repeatedly to catch it.

What site owners should do

Wordfence said two of the largest sources repeatedly probed small groups of sites for roughly 14.5 hours, behaviour consistent with trying to catch the brief upgrade window, while other sources tested many staging-directory and version-name variations. Site owners should update immediately, watch for suspicious requests to PHP files under wp-content/upgrade, and check for unfamiliar administrator accounts, plugins or PHP files. A successful attack could give an unauthenticated attacker control of the server, so the update should not wait for a routine maintenance window.

Sources: The Hacker News | Wordfence