WordPress is scrambling to contain a spike in attacks following the discovery of a critical remote code execution (RCE) flaw in its core. In just 24 hours after security patches went live, threat analysts observed nearly 63,000 exploitation attempts targeting the vulnerability.
What the Vulnerability Entails
The flaw impacts WordPress Core versions 4.7 up to 7.1.3, and carries a high severity rating of 8.1 out of 10 in the CVSS system. It exploits predictable, web-accessible staging paths used during full-package core updates. Attackers who time it right while WordPress is unpacking core files into a “wp-content/upgrade” staging folder can gain unauthenticated access to run code on the server. This includes accessing the installer scripts temporarily present during the update process.
Exploit conditions include availability of full-package updates with installer files, public web and PHP access to the staging directory, use of a predictable path, and a narrow window before WordPress removes temporary files. Even a brief timing misstep can block the exploit.
Attack Volume & Mitigation Urgency
Wordfence, the security firm monitoring the situation, blocked 62,969 attack attempts in the past 24 hours alone. Two major attacker sources were found sweeping small groups of WordPress sites for roughly 14½ hours, cycling through possible version names and staging paths to trigger the race condition. Others probed directory layouts and files with precision.
To counter the threat, WordPress released version 7.1.4 on October 28, 2026, which patches the issue. Site administrators are being urged to update immediately. Key warning signs include unusual HTTP requests to PHP files under “wp-content/upgrade,” unknown admin user accounts, odd plugins or unexpected PHP files appearing in directories.
If your site allows full core updates, has “wp-content/upgrade” staging mirror during updates, or exposes PHP execution under that path—even briefly—your WordPress instance may be at risk. It’s the kind of flaw where fleeting windows can yield lasting damage.
This is a reminder that even mature platforms like WordPress can harbor vulnerabilities rooted in routine processes. It underscores the need not just for fast patch deployment but also for secure update workflows—especially around temporary directories or web-accessible install scripts. What to watch: whether hosting providers enforce protections on staging paths, whether this flaw is linked to an official CVE soon, and how threat actors adapt now that detection and patching are in motion.
