WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours Ravie LakshmananOct 30, 2026Vulnerability / Web Security Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026. "This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said. "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window." The WordPress security company noted that successful exploitation requires an "attacker to hit a very narrow window while WordPress is unpacking a complete Core update." The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under "wp-content/upgrade." This copy also includes the WordPress installer. "Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution," Alex Thomas, who leads the Wordfence Threat Response Team, said. A threat actor who is able to win the race condition can gain the ability to execute code on the server, assuming the following conditions are met - A full-package update containing the installer files Public web and PHP access to the staging tree A predictable or discovered staging path, and Adequate time to complete the attack before WordPress cleans up the temporary files Although that window has been observed to last only seconds in normal lab environments, threat actors are polling vulnerable paths, such as "setup-config.php," repeatedly in an attempt to trigger the flaw. Over the past 24 hours, Wordfence said it has blocked 62,969 attacks targeting the vulnerability. "Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window," Thomas said. "Other sources tested many staging-directory and version-name variations." "Not every request used the exact vulnerable path, but the sustained polling and exact-layout probes show that attackers quickly understood the race condition and began targeting it." With active exploitation attempts already underway, WordPress site owners are advised to update to version 7.1.4 as soon as possible and look for suspicious requests to PHP files located under "wp-content/upgrade," as well as unfamiliar administrator accounts, plugins, or PHP files. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, Vulnerability, Web Security, WordPress PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security Your Backup Isn't Ransomware-Proof Just Because It Exists The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them