cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

WordPress RCE Flaw Draws 62,969 Blocked Exploit Attempts in 24 Hours

· Original article ↗

Summary

Wordfence reported blocking 62,969 attempts targeting a WordPress Core RCE flaw in 24 hours. The race condition affects versions 4.7 through 7.1.3; site owners are urged to update to 7.1.4.

Key points

  • The high-severity flaw affects WordPress Core versions 4.7 through 7.1.3 and has a CVSS score of 8.1; no CVE identifier is provided.
  • During full-package core upgrades, files are unpacked into a predictable, often web-accessible staging directory under wp-content/upgrade.
  • An unauthenticated attacker may be able to request the staged installer during a brief upgrade window and execute PHP code on the server.
  • Wordfence said the window can last only seconds in normal lab environments and reported blocking 62,969 targeting attempts over 24 hours.
  • Wordfence described repeated polling and probes of staging-directory and version-name variations, but the article does not confirm successful exploitation.
  • Patches were released October 28, 2026; site owners are advised to update to WordPress 7.1.4 and check for suspicious PHP requests and unfamiliar accounts, plugins, or files.

Article Details

Vulnerability Types
  • Remote code execution (RCE)
  • Race condition
Severity
High (CVSS 8.1)
Affected Versions
  • WordPress Core 4.7 through 7.1.3
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers repeatedly probed vulnerable WordPress sites and staging paths in an attempt to exploit the Core flaw through the web-accessible upgrade process.

People

Alex ThomasLeads the Wordfence Threat Response Team and described the race condition and observed attacker polling behavior.

Vendors

Wordfence"This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said. "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade

Products

WordPress CoreThreat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.

Related Articles