WordPress Core RCE flaw attracts 62,969 attempts in one day
WordPress upgrade flaw draws rapid attack activity
Threat actors made 62,969 attempts to exploit a high-severity remote code execution flaw in WordPress Core during the 24 hours after patches became available, Wordfence said. The issue affects WordPress Core versions 4.7 through 7.1.3 and has a CVSS score of 8.1.
WordPress released patches on October 28, 2026. Site owners are advised to update to version 7.1.4 as soon as possible because attackers have already begun sustained probing of vulnerable sites.
The flaw has no CVE identifier. It concerns the handling of full-package Core upgrades, rather than a conventional weakness in a permanently exposed WordPress component.
Predictable staging paths create a narrow opportunity
During a full-package update, affected installations can unpack new files into a predictable directory under wp-content/upgrade. That staged copy includes the WordPress installer.
On servers where the staging directory is accessible through the web and PHP is available, an unauthenticated attacker may request the installer at the precise moment the files are present. Wordfence said this could allow the attacker to interact with the staged WordPress copy and progress to PHP code execution on the server.
Successful exploitation depends on several conditions: a full-package update must contain the installer files; the staging tree must have public web and PHP access; the attacker must know or discover the path; and the attack must finish before WordPress removes the temporary files.
Wordfence said the window normally lasts only seconds in laboratory conditions. Attackers are nevertheless repeatedly polling paths such as setup-config.php in an effort to catch an installation while the staged files remain available.
Polling shows attackers understood the race condition
Alex Thomas, who leads the Wordfence Threat Response Team, said two of the largest attack sources repeatedly polled small groups of sites for roughly 14.5 hours. Other sources tried multiple staging-directory and version-name variations.
Not every request used the exact vulnerable path, but the sustained polling and layout probes indicate that attackers quickly adapted their activity to the race condition. The attack volume also shows why the brief upgrade period should not be treated as a meaningful security control.
What site operators should check
Organizations should upgrade affected WordPress installations to version 7.1.4 and examine logs for suspicious requests to PHP files beneath wp-content/upgrade. Administrators should also look for unfamiliar administrator accounts, plugins, or PHP files that could indicate unwanted changes after an attempted compromise.
For businesses operating WordPress sites, the practical implication is clear: treat Core update workflows as part of the attack surface, apply version 7.1.4 promptly, and include staging-directory requests in incident review and monitoring.