Cybersecurity experts are alerting WordPress users about a significant security flaw that has been actively targeted by attackers, with close to 63,000 attempts recorded in a single day. This vulnerability in WordPress Core, affecting versions from 4.7 to 7.1.3, surfaced shortly after new patches were released on October 28, 2026.
Understanding the WordPress Flaw
The security issue in question relates to a remote code execution problem in WordPress Core, which has been assigned a high CVSS score of 8.1. The flaw enables attackers to execute arbitrary code on servers during the upgrade process. According to Wordfence, the vulnerability stems from predictable, web-accessible staging paths utilized during full-package core upgrades.
Crucially, successful exploitation depends on attackers executing their code precisely when WordPress is unpacking a Core update. This momentary vulnerability window offers an opportunity for unauthenticated individuals to interact with the staged WordPress files and potentially execute PHP code.
Exploitation Attempts and Statistics
Wordfence, a prominent WordPress security firm, has revealed that over 62,969 attacks have been blocked in the past 24 hours. These attacks target paths like “setup-config.php” in hopes of activating the flaw. Alex Thomas of the Wordfence Threat Response Team explained that attackers are exploiting this race condition by polling vulnerable paths repeatedly.
In particular, two major sources of attacks were observed persistently probing a small group of websites for about 14.5 hours, aiming to exploit the brief upgrade window. Other threat actors have been experimenting with different staging-directory and version-name variations to find a successful method of attack.
Protective Measures for WordPress Users
Given the ongoing attempts to exploit this vulnerability, WordPress site administrators are urged to upgrade to version 7.1.4 immediately. This update mitigates the risk of exploitation. Additionally, users should monitor for unusual PHP file requests within the “wp-content/upgrade” directory and watch for unfamiliar administrator accounts or plugins.
As the race to secure websites continues, staying informed and proactive is essential. By updating their systems and keeping vigilant, site owners can protect their platforms from potential threats and maintain the integrity of their WordPress sites.
