WordPress Fix Draws 18,500 Exploit Attempts in 21 Hours

Threat actors began probing a newly patched WordPress vulnerability within hours of the fix being released, with Defiant reporting a high-severity unauthenticated race condition in the WordPress Core update process that can lead to remote code execution. The issue, patched in WordPress 7.1.4 on 28 October 2026, affects the upgrade workflow by exploiting predictable, web-accessible staging paths during updates, allowing an attacker to trigger code execution without authentication.

Defiant notes that exploitation depends on hitting a narrow window while WordPress unpacks a complete Core update, and that the attack requires access to the installer files, public web and PHP access to the staging tree, plus a discovered or predictable staging path.

Defiant and Wordfence indicate threat actors are actively attempting exploitation, with defenders observing a rapid surge of attempts targeting staged setup-config.php installer paths. Wordfence telemetry reports the first firewall rule match occurred nine minutes after deployment and, in the first 21 hours, more than 18,500 requests targeting vulnerable staging paths were seen; however, there have been no confirmed compromises to date.

WordPress 7.1.4 also backported fixes to branches through WordPress 4.7 and includes patches for 22 security defects, such as XSS and information-disclosure flaws, plus an update to bundled root certificates reflecting the Emudhra revocation. No CVE identifier had been assigned to the vulnerability at the time of reporting.