WordPress core RCE drew 60,471 attack attempts in 24 hours
Original title: Hackers Launch Over 60,000 Attacks Targeting WordPress RCE Vulnerability in 24 Hours
Wordfence blocked the attempts after WordPress 7.1.4; the count does not show how many sites were compromised.
Wordfence recorded 60,471 blocked attempts in 24 hours against a WordPress Core remote code execution flaw that can appear during Core upgrades. WordPress 7.1.4, released October 28, 2026, fixes that race condition and 21 other issues. An unauthenticated attacker who hits a briefly exposed temporary installer could point it at a database they control. The figure counts firewall blocks, not confirmed compromises.
Unconfirmed: Blocked attempts do not establish successful code execution or how many sites were targeted.
- Premium, Care, and Response customers got a firewall rule about three hours after release.
- Free Wordfence users are scheduled to receive that rule on November 27.
- Patched releases include 7.1.4, 7.0.8, 6.9.11, and backports through 4.7.39.
- WordPress 4.6 and earlier no longer receive security updates.
- The patch randomizes temporary folder names with 16 characters.
Impact: Possible code execution during a Core upgrade
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | Branches needing the security release; 4.6 and earlier unsupported | 7.1.4, 7.0.8, 6.9.11, and backports through 4.7.39 |
- 1.Install WordPress 7.1.4 or the matching security release for the site's branch.
- 2.Confirm the update finished rather than assuming automatic background updates completed.
- 3.Restrict public web access to wp-content/upgrade/.
From the original article
3 min read at cybersecuritynews.com
Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24 hours. These are attack attempts, not confirmed website compromises, and the figure does not establish how many individual sites were targeted.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.