WordPress RCE flaw draws 62,969 attack attempts in 24 hours

WordPress Core versions 4.7 to 7.1.3 were found to be affected by a high‑severity remote code execution flaw that could be exploited during the upgrade window. Patches were released on 28 October 2026, with a CVSS score of 8.1. The issue arises from predictable, web‑accessible staging paths used when applying a full‑package Core upgrade, which can allow unauthenticated attackers to run PHP code on the server while WordPress is unpacking the update.

Wordfence researchers explain that exploitation hinges on a narrow race window during the upgrade process, when a staged WordPress copy and the installer are exposed in a public directory under wp-content/upgrade.

Wordfence has observed a surge of exploitation attempts targeting this vulnerability, reporting 62,969 attacks in the last 24 hours. They note that attackers are specifically polling vulnerable staging paths such as setup-config.php and variations in version names, with two large sources attempting to exploit the window for extended periods (around 14.5 hours).

The team emphasises that not every request hits the exact vulnerable path, but the persistent probing demonstrates attackers’ understanding of the race condition. WordPress site owners are advised to upgrade to version 7.1.4 as soon as possible and to monitor for suspicious requests to PHP files under wp-content/upgrade or for unfamiliar administrator accounts, plugins, or PHP files.