Unpatched WordPress Sites Face Tens of Thousands of Attacks Following RCE Flaw Disclosure

WordPress Core Vulnerability Triggers Mass Scanning

Security researchers have reported a surge in automated attack attempts targeting a high-severity remote code execution (RCE) flaw in WordPress Core. According to security firm Wordfence, nearly 63,000 exploitation attempts were blocked within a 24-hour period shortly after patches became publicly available.

The vulnerability affects WordPress Core versions 4.7 through 7.1.3 and carries a CVSS severity score of 8.1. Official patches to address the issue were released on October 28, 2026. While the vulnerability does not currently have an assigned CVE identifier, it stems from predictable staging paths utilized during full-package core updates.

Understanding the Race Condition Mechanism

According to analysis published by Wordfence, the security flaw involves how WordPress handles files during full-package core upgrades:

• Unpacking occurs in a predictable directory located under `wp-content/upgrade`.
• This staging directory includes the WordPress installer and remains web-accessible on numerous server configurations.
• Unauthenticated attackers can potentially achieve PHP code execution if they interact with the staged copy during a narrow update window.

Alex Thomas, who leads the Wordfence Threat Response Team, explained that successful exploitation requires hitting a very narrow race condition while WordPress unpacks the complete core update. Although this vulnerable window may last only seconds in laboratory conditions, automated tools have been actively polling target paths.

Observed Attacker Tactics and Techniques

Monitoring data reveals that threat actors are employing persistent automated techniques to catch the brief operational window:

• Attackers repeatedly polled vulnerable paths such as `setup-config.php` across targeted sites.
• Sustained polling campaigns from major sources lasted for roughly 14.5 hours on certain targets.
• Other malicious actors tested various permutations of staging directories and version-name structures.

Recommended Mitigation Steps

Website administrators and security teams are advised to take immediate action to protect vulnerable installations:

• Update WordPress Core to version 7.1.4 or later immediately.
• Review server logs and file systems for unauthorized PHP files or suspicious requests directed at the `wp-content/upgrade` directory.
• Audit environments regularly for unfamiliar administrator accounts, newly installed plugins, or anomalous script activity.

To verify official announcements and updates, administrators should consult the official WordPress security releases page and trusted threat intelligence advisories.