Vulnerabilities · Application Security
Attackers target WordPress flaw with 63,000 attempts in one day
Hackers tried nearly 63,000 times in 24 hours to exploit a WordPress flaw that lets them run code on vulnerable sites. Site owners are urged to update to version 7.1.4 immediately.
Ross GrantUpdated 2 min read
The short version
Hackers tried almost 63,000 times in one day to break into WordPress sites using a newly discovered flaw. This bug lets them run their own code on vulnerable websites during updates. If you run a WordPress site, update to version 7.1.4 or later right away. This will protect your site from this attack.
By the numbers
- 62,969attack attempts blocked in 24 hoursThe Hacker News
- 4.7–7.1.3WordPress versions affectedThe Hacker News
- 8.1CVSS score (severity rating) for the flawThe Hacker News
- 7.1.4patched WordPress versionThe Hacker News
What happened?
Hackers attempted nearly 63,000 times in 24 hours to exploit a remote code execution flaw in WordPress Core. The flaw affects versions 4.7 through 7.1.3 and lets attackers run code on servers during a brief window in the update process. Patches were released on 28 October 2026. Only The Hacker News has reported this so far.
How the flaw works
A high-severity vulnerability in WordPress Core allowed attackers to run their own code on servers during a specific moment in the update process. The flaw affects WordPress versions 4.7 through 7.1.3 and has a CVSS score of 8.1, which signals a serious risk. According to The Hacker News (opens in a new tab), the problem comes from how WordPress handles full-package core upgrades. During these upgrades, files are unpacked into a predictable directory under wp-content/upgrade, which is often accessible from the web.
If an attacker requests the installer at exactly the right moment, while WordPress is unpacking the update, they can interact with the staged copy and execute PHP code on the server. This is known as a race condition, where the attacker must act within a very short window before WordPress cleans up the temporary files. The window typically lasts only seconds, but attackers have automated their attempts to catch it.
Who is affected
The flaw impacts any website running WordPress Core versions 4.7 through 7.1.3. Attackers do not need to be logged in to exploit it. The risk is highest for sites that allow public web and PHP access to the wp-content/upgrade directory. According to Wordfence, a WordPress security company, they blocked 62,969 attack attempts in just 24 hours, showing that attackers quickly moved to exploit the vulnerability after the patch was released.
The response
Patches for the vulnerability were released on 28 October 2026. WordPress site owners are strongly advised to update to version 7.1.4 or later as soon as possible. Wordfence also recommends checking server logs for suspicious requests to PHP files in the wp-content/upgrade directory and looking for unfamiliar administrator accounts, plugins, or PHP files, which could signal a successful attack.
What you should do
If you manage a WordPress site, update to version 7.1.4 immediately. Review your server logs for repeated requests to files like setup-config.php in the wp-content/upgrade directory. Remove any unknown plugins or administrator accounts. If you find suspicious files or activity, consider restoring from a known good backup and resetting credentials for all admin users.
Is there a fix?
Yes. Updating to WordPress 7.1.4 or later protects against this vulnerability. The patch changes how updates are handled so that attackers can no longer access the temporary files during the upgrade process.
Why it matters
WordPress powers a large share of the web, so a flaw like this puts many sites at risk. Attackers are already trying to exploit it, and the attack can succeed even if the site owner does nothing wrong. Fast patching is critical.
Key points
- Nearly 63,000 attack attempts were recorded in 24 hours targeting WordPress sites.
- The flaw allows remote code execution during a brief update window.
- All WordPress sites running versions 4.7 to 7.1.3 are at risk.
- A patch (version 7.1.4) is available and should be applied immediately.
- Attackers do not need to be logged in to exploit this flaw.
Sources
The Hacker News
Reference
