Attack attempts targeting a WordPress core remote code execution vulnerability topped 60,000 in 24 hours, according to a report on 31 October citing security firm Wordfence, which said it blocked 60,471 attempts over a single day. The figure counts attempts, not confirmed site compromises, and the number of individual sites targeted cannot be determined from the figure alone.

WordPress released version 7.1.4 on 28 October, fixing 22 security vulnerabilities, including a code execution flaw as well as stored cross-site scripting, information exposure and permission issues. The vulnerability targets a race condition: WordPress briefly creates temporary installation files during an upgrade, and an attacker can link the installer to a database the attacker controls in order to run code on the server. The window for an attack is usually only a few seconds, which is why the flaw is dangerous during updates themselves rather than at rest.

What site owners should do

The lesson for site owners is straightforward: update promptly to 7.1.4 or later, and do not leave updates half-finished on a busy server. Administrators should also check for unexpected administrator accounts, unfamiliar files and unexplained changes after an upgrade, and restore from a known-clean backup if anything looks wrong. With tens of thousands of attempts a day, attackers are clearly scanning for sites that have not yet patched, and the gap between a security release and a site's update is exactly the window they are trying to exploit.