WordPress update RCE attacked hours after the 7.1.4 patch
Original title: Hackers Actively Exploiting WordPress Remote Code Execution Flaw Just Hours After Patch Release
Wordfence logged more than 18,500 requests to temporary installer paths in 21 hours; Core 4.7 through 7.1.3 is affected.
WordPress 7.1.4, released October 28, 2026, fixes 22 issues, including an unauthenticated code-execution flaw in the update process reported by Umut Bayram. Affected Core versions 4.7 through 7.1.3 unpack a complete package into a predictable folder under wp-content/upgrade; if that path allows public PHP execution, an attacker can hit the staged installer before cleanup. Wordfence deployed a firewall rule about three hours after the release and saw the first matching request nine minutes later. The report records exploitation attempts but not how many sites were breached.
Unconfirmed: The monitoring shows exploitation attempts but does not establish how many sites were successfully breached.
- The flaw has a CVSS score of 8.1, according to the supplied report.
- In lab tests the temporary folder stayed available for only seconds.
- The patch randomizes the staging folder, adds an index guard, and blocks unsafe staged configuration handling.
- Wordfence free users are scheduled to get the rule on November 27, 2026.
- The release also fixes stored cross-site scripting, information disclosure, and permission issues.
Impact: Unauthenticated remote code execution during a Core update
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 4.7 through 7.1.3 | 7.1.4; fixes also for older branches through 4.7 |
- 1.Install WordPress 7.1.4 or the fixed release for the installed branch.
- 2.Review requests to PHP files beneath wp-content/upgrade and unexpected admin accounts, plugins, or files.
- 3.Enable Wordfence Extended Protection so the firewall loads before directly requested PHP.
- Vendors
- WordPress
- Products
- WordPress CoreWordfence
From the original article
2 min read at cybersecuritynews.com
A WordPress remote code execution vulnerability came under attack just hours after version 7. 1. 4 was released on October 28, 2026, fixing 22 vulnerabilities, including an unauthenticated code execution flaw in the update process.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.