Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24 hours.
These are attack attempts, not confirmed website compromises, and the figure does not establish how many individual sites were targeted.
WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The update closes the code execution weakness alongside stored cross-site scripting, information disclosure, and permission issues.
The official WordPress announcement urges administrators to update immediately and credits researcher Umut Bayram with reporting the upgrade flaw.
WordPress RCE Vulnerability
The vulnerability involves a race condition, meaning an attacker must reach a temporary installation at precisely the right moment. Unlike flaws requiring stolen passwords or an existing account, this issue can be targeted without logging in. However, successful exploitation depends on conditions present during a complete WordPress Core upgrade.
During that process, WordPress extracts update files into a temporary staging directory. Predictable folder names and publicly accessible installation files can briefly expose a separate WordPress installer. An attacker reaching that installer could connect it to a database they control, creating a route toward running code on the server.
Cybersecuritynews.com’s earlier WordPress 7.1.4 security update coverage explains that the patch adds 16 random characters to temporary folder names, restores protective index.php handling, and prevents wp-config.php from being copied from the working directory. These changes address the exposed staging process rather than a vulnerable third-party plugin.
The attack window typically lasts only seconds, making exploitation difficult rather than impossible. Repeated requests give attackers more opportunities to encounter a site while its update files are exposed. Wordfence has reported exploitation attempts following the security release, showing that attackers are testing the weakness despite its timing requirements.
Cybersecuritynews.com also covered the active WordPress exploitation attempts. The important distinction is between requests blocked by a firewall and successful code execution. A large request count shows attack activity, but it does not prove that attackers gained access to an equally large number of websites.
The supplied Wordfence advisory states that Premium, Care, and Response customers received a firewall rule on October 28, roughly three hours after release. Free users are scheduled to receive that rule on November 27, following the standard 30-day delay. Administrators should not wait for that protection before installing the patch.
Update WordPress and Verify Protection
Site owners should open the Dashboard, select Updates, and confirm that WordPress 7.1.4 is installed. Websites using older branches need their corresponding security release. The official version documentation lists patched versions including 7.0.8, 6.9.11, and backports extending through 4.7.39. WordPress versions 4.6 and earlier no longer receive security updates.
Automatic background updates should deliver the release on supported configurations, but administrators should verify completion instead of assuming their websites are protected. The documentation also makes clear that only the latest WordPress version remains actively supported. Older branch fixes provide an update path, not a reason to postpone maintenance.
Administrators can also restrict public web access to wp-content/upgrade/ as added protection. A plugin firewall alone may not cover the extracted installer because it loads separately from the main site. Applying the Core security update remains the central fix for this vulnerability during the upgrade process.
AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?
