In a concerning development, hackers have launched a series of attacks targeting a remote code execution (RCE) vulnerability within WordPress Core. This flaw, which becomes evident during software updates, has resulted in 60,471 blocked attempts in just 24 hours, as reported by Wordfence. These numbers highlight the urgency for website administrators to act swiftly and ensure their site’s security.
Understanding the WordPress RCE Vulnerability
The RCE vulnerability in WordPress involves a race condition. This flaw allows attackers to exploit a temporary installation if they time their actions precisely. Unlike vulnerabilities that require prior access, such as stolen credentials, this issue can be targeted without logging in. The exploit can occur when WordPress is updating its Core, extracting files into a temporary directory. An attacker connecting to a predictable folder and publicly accessible files can potentially run unauthorized code on the server.
WordPress addressed this vulnerability in its version 7.1.4 update, released on October 28, 2026. The update not only resolves the RCE issue but also tackles stored cross-site scripting, information leaks, and permission concerns. The latest patch introduces random character sequences to temporary folder names, reinstates protective index.php handling, and prevents sensitive configuration files from being improperly accessed.
The Scale and Response to the Attacks
Cybersecurity analysts have observed that while the attack window is brief, typically lasting only seconds, persistent attempts increase the likelihood of encountering an exposed site. Despite the challenge of exploitation, repeated requests have been reported by Wordfence, emphasizing the need for vigilance among site owners. Notably, the distinction between blocked requests and successful intrusions is crucial; a high number of attempts does not equate to successful breaches.
Following the release of the security update, Wordfence deployed a new firewall rule specifically for Premium, Care, and Response customers within three hours. Free users are expected to receive this protection after the standard 30-day period on November 27. However, Wordfence advises administrators not to delay applying the security patch, as relying solely on firewall updates may not offer comprehensive protection.
Steps to Secure WordPress Installations
To safeguard their websites, administrators should immediately verify that WordPress 7.1.4 is installed via the Dashboard’s Updates section. Sites on older branches must apply their respective security updates, as versions prior to 4.6 do not receive ongoing security fixes. Automatic updates might apply these patches, but manual verification is recommended to ensure complete protection.
Additionally, restricting public access to the wp-content/upgrade/ directory can help mitigate potential threats. While plugin firewalls offer some defense, they may not protect against vulnerabilities that arise during the update process. Therefore, applying the Core security update remains the most effective measure against this WordPress vulnerability.
As cyberattacks become increasingly sophisticated and rapid, partly due to advances in AI technologies, maintaining robust cybersecurity practices is essential. Site owners must stay informed about updates and proactively secure their platforms against emerging threats.
