Attackers probe WordPress core race; 62,969 attempts in a day
Original title: WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.
Wordfence says attackers are trying a high-severity WordPress Core remote code execution flaw that has no CVE identifier. Versions 4.7 through 7.1.3 unpack a full-package update, including the installer, into a predictable web-accessible path. An unauthenticated request at the right moment can reach PHP execution. Patches shipped on October 28, 2026, and Wordfence blocked 62,969 attempts in 24 hours.
Unconfirmed: Wordfence reports blocked exploitation attempts; the article does not confirm successful compromises.
- The flaw is scored CVSS 8.1 and is fixed in WordPress 7.1.4.
- Exploitation needs a full-package update, public PHP access to the staging tree, and a short cleanup window.
- Two large sources polled small groups of sites for about 14.5 hours, Wordfence said.
- Owners should watch PHP requests under wp-content/upgrade and unfamiliar admin accounts, plugins, or PHP files.
Impact: Unauthenticated PHP code execution during a core upgrade
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 4.7 through 7.1.3 | 7.1.4 |
- 1.Update WordPress Core to 7.1.4 as soon as possible.
- 2.Look for suspicious requests to PHP files under wp-content/upgrade.
- 3.Check for unfamiliar administrator accounts, plugins, or PHP files.
- Vendors
- WordPress
- Products
- WordPress Core
- Organizations
- Wordfence
From the original article
2 min read at thehackernews.com
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4. 7 through 7.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.