WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in 24 Hours After Patch Release

Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in 24 Hours After Patch Release

What happened

A high-severity remote code execution vulnerability in WordPress Core versions 4.7 through 7.1.3 has already drawn heavy attack traffic shortly after patch disclosure. According to The Hacker News, Wordfence blocked 62,969 attack attempts in just 24 hours after the issue was disclosed on October 28, 2026, with the report published on October 30, 2026. The flaw is rated CVSS 8.1 and, according to the source, no CVE had been assigned at the time of publication. The Hacker News, 2026-10-30

How the flaw works

The vulnerability stems from predictable, web-accessible staging paths under wp-content/upgrade that are used during full-package WordPress core upgrades. The reported concern is that these staging directories can be publicly reachable and may contain the WordPress installer during the upgrade process, creating a narrow opportunity for unauthenticated attackers to execute PHP code if they can access the installer before temporary files are removed. The Hacker News, 2026-10-30

The source says exploitation depends on several conditions aligning at once: the site must be undergoing a full-package update, the staging tree must have public web and PHP access, the attacker must know or predict the staging path, and the attack must complete before WordPress deletes the temporary files. That makes the window brief, but not negligible. The Hacker News, 2026-10-30

Why defenders should care now

Even with a narrow exploitation window, the attack volume reported by Wordfence suggests threat actors were actively probing for vulnerable upgrade paths almost immediately after disclosure. The report says attackers repeatedly polled paths such as setup-config.php, indicating automated scanning or repeated targeting of likely installer locations. The Hacker News, 2026-10-30

For site operators, the main takeaway is straightforward: patch quickly and watch for suspicious requests to PHP files inside wp-content/upgrade. The source advises updating to WordPress 7.1.4 immediately. The Hacker News, 2026-10-30

Conclusion

This is a reminder that even short-lived upgrade states can become attack surfaces when they expose predictable paths to web access. The reported volume of attack attempts within 24 hours of disclosure underscores how quickly opportunistic actors move when a potentially exploitable WordPress issue becomes public. For affected sites, the immediate priority is upgrading to 7.1.4 and reviewing web logs for unusual activity tied to the upgrade directory. The Hacker News, 2026-10-30

Sources and dates

Research completed: 2026-10-31T05:07:00Z

Building your own website?

This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.