A WordPress remote code execution vulnerability came under attack just hours after version 7.1.4 was released on October 28, 2026, fixing 22 vulnerabilities, including an unauthenticated code execution flaw in the update process. Site owners should verify that the patch is installed.
According to Wordfence’s supplied threat report, its firewall recorded more than 18,500 requests targeting temporary installer paths during the first 21 hours of monitoring. These requests show active exploitation attempts, but the report does not establish how many websites, if any, were successfully breached.
The vulnerability affects WordPress Core versions 4.7 through 7.1.3 and carries a CVSS severity score of 8.1, according to the supplied report. Researcher Umut Bayram reported the update process weakness, which WordPress confirmed in its security release announcement.
During an update using a complete WordPress package, affected installations unpack files into a predictable folder beneath wp-content/upgrade. That temporary copy includes installer files. If the server allows public access and PHP execution in this location, an attacker can reach the staged installer before WordPress removes it.
WordPress RCE Flaw Exploited Hours After Patch
Successful exploitation depends on precise timing. In Wordfence’s laboratory tests, the temporary folder remained available for only seconds. Attackers must locate the right path and complete the required steps before cleanup finishes. Repeated requests improve their chances of catching that brief opening.
Cybersecuritynews.com’s earlier WordPress 7.1.4 security coverage also explains why the extracted installer needs special attention from site defenders.
Wordfence said it deployed a firewall rule at 20:30 UTC on October 28, roughly three hours after the release announcement. The first matching request appeared nine minutes later.
Two major sources repeatedly checked small groups of websites for about 14.5 hours. Other sources tried different staging folders and version names. This pattern fits attempts to catch the update window, although not every request matched a valid vulnerable path.
The flaw differs from other WordPress code execution bugs in its timing requirements. For comparison, Cybersecuritynews.com previously covered an Imagick-related WordPress RCE flaw that required an Author account or higher privileges.
According to the Wordfence-supplied report, the patch randomizes the staging folder, adds an index guard, and blocks unsafe handling of staged configuration data.
WordPress also released fixes for older branches through version 4.7, though only the latest release receives active support. Administrators can check their installed version under Dashboard > Updates.
Wordfence Premium, Care, and Response customers received the new rule immediately. Free users are scheduled to receive it on November 27, 2026. Sites using Wordfence should enable Extended Protection.
This loads the firewall before directly requested PHP files run, unlike basic protection, which loads through WordPress. That difference matters because these attacks request the staged installer directly. Firewall coverage does not replace updating Core.
Administrators should review requests to PHP files beneath wp-content/upgrade, investigate unfamiliar administrator accounts and plugins, and scan for unexpected file changes.
The release also fixes stored cross-site scripting, information disclosure, and permission issues, making prompt updates important beyond this single RCE flaw.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
