Attackers Pounce on WordPress Core Flaw: Nearly 63,000 Attempts Blocked in One Day

Attackers have begun targeting a high-severity flaw in WordPress Core soon after patches were released on October 28, 2026. The bug allows remote code execution, meaning an attacker could run their own code on the web server. It affects versions 4.7 through 7.1.3, has a CVSS score of 8.1, and does not have a CVE identifier. Wordfence reports it blocked 62,969 attacks aimed at the flaw over the past 24 hours.

According to Wordfence, the problem lies in how full-package core upgrades work. Affected versions unpack new files into a predictable folder under "wp-content/upgrade", and that copy includes the WordPress installer. On many servers this folder can be reached from the web, so an unauthenticated attacker who requests the installer at exactly the right moment could progress to running code. The window is very narrow, lasting only seconds in normal lab environments, so success depends on perfect timing.

That has not stopped attackers. Wordfence saw repeated requests to paths such as "setup-config.php", and two of the largest sources polled small groups of sites for roughly 14.5 hours, behaviour consistent with waiting for an upgrade to begin. Site owners should update to version 7.1.4 as soon as possible, and check for suspicious requests to PHP files under "wp-content/upgrade", as well as unfamiliar administrator accounts, plugins or PHP files.