WordPress Core flaw exploited to run code on vulnerable sites

Wordfence warned on 29 October 2026 that threat actors are actively exploiting a critical WordPress Core vulnerability in the wild. The flaw affects WordPress Core versions 4.7 through 7.1.3 and allows unauthenticated attackers to execute arbitrary code during full-package core upgrades. WordPress 7.1.4 and security releases backported to earlier branches address the issue.

Wordfence notes that exploitation has been observed in the wild, with its telemetry recording more than 18,500 malicious requests targeting staged installer paths within 21 hours. The advisory also states that, as of reporting, no working public proof-of-concept exploit code had been confirmed and MITRE had not yet assigned an official CVE identifier.

The vulnerability arises from predictable, web-accessible staging paths used during core upgrades. Researcher Umut Bayram identified the issue, which carries a CVSS score of 8.1. The upgrade process unpacks files into a predictable directory under wp-content/upgrade, and many servers expose this staging area to the web. If an unauthenticated attacker accesses the staged setup-config.php file during unpacking, they can execute PHP code on the server.

To mitigate, WordPress released 7.1.4 with a randomised staging directory and index protection, and backported the fix to branches down to 4.7. Administrators are advised to run WordPress 7.1.4 or newer and consider restricting access to wp-content/upgrade at the web server level. The release also addresses 21 additional vulnerabilities noted in the WordPress 7.1.4 documentation.