NEWS

WordPress Core RCE Flaw Draws Nearly 63,000 Attack Attempts in 24 Hours

An unauthenticated RCE race condition in WordPress Core 4.7 through 7.1.3 is under attack within a day of the 7.1.4 patch. Update now.

Dylan H.

Security Team

October 30, 2026
2 min read
WordPress Core RCE Flaw Draws Nearly 63,000 Attack Attempts in 24 Hours

Overview

Attackers began exploiting a high-severity remote code execution flaw in WordPress Core shortly after patches shipped. The bug has no CVE identifier, carries a CVSS score of 8.1, and affects every release from 4.7 through 7.1.3. WordPress 7.1.4, released October 28, 2026, fixes it. Wordfence reported blocking 62,969 attack attempts against the flaw in a single 24-hour window.

How the Flaw Works

According to Wordfence research (Alex Thomas), during full-package Core upgrades, affected versions unpack files into a predictable, web-accessible staging directory under wp-content/upgrade. That copy includes the WordPress installer. An attacker who requests the installer during the brief unpacking window can progress to PHP code execution. Wordfence describes the issue as a race condition.

Exploitation requires all of the following:

  • A full-package update that includes installer files
  • Public web and PHP access to the staging tree
  • A predictable or discoverable path
  • Enough time before WordPress deletes the temporary files

Because the window is short, attackers are polling rather than waiting for a single hit.

Observed Attack Activity

  • 62,969 blocked attacks in 24 hours (Wordfence)
  • Two of the largest sources polled small groups of sites for roughly 14.5 hours
  • Probes for paths such as setup-config.php
  • Many directory and version-name variations tested to find the staging path

Recommendations

  1. Update to WordPress 7.1.4 immediately. Enable automatic Core updates where possible.
  2. Review web logs for requests to PHP files under wp-content/upgrade.
  3. Audit for compromise: look for unfamiliar administrator accounts, plugins, themes, or PHP files.
  4. Block web access to wp-content/upgrade at the web server or WAF where your hosting setup allows it.
  5. Schedule upgrades during low-traffic periods and watch for unexpected requests while they run.

Why It Matters

WordPress powers a large share of the web, and the affected range spans almost a decade of releases. Exploit attempts at this volume within a day of the patch mean opportunistic scanning is already underway, so unpatched sites should be treated as at risk.

Sources