Vulnerabilities · 3h ago
Wordfence recorded more than 18,500 requests targeting WordPress Core’s staged installer paths in the 21 hours after the October 28 release of WordPress 7.1.4; it has reported no successful compromises.
During a full Core update, WordPress briefly unpacks installer files into a temporary folder with a predictable name that may be reachable from the web. Attackers repeatedly check the folder to catch the seconds before cleanup. The unauthenticated race condition can allow remote code execution if an attacker reaches the staging files in time.
For self-hosted sites, exposure depends on configuration and timing as well as the installed version: attackers are probing for a publicly reachable staging tree during a full update. The request count shows attempts, not confirmed access, so the scale of any actual compromise remains unknown.
2 sources covering this story
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Attackers target a WordPress Core RCE flaw during upgrades, with Wordfence blocking 62,969 attempts in 24 hours.
Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
Part of the PlainSec briefing for 2026-10-30