Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.
The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026.
“This is due to predictable, web-accessible staging paths used during full-package core upgrades,” Wordfence said. “This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.”
The WordPress security company noted that successful exploitation requires an “attacker to hit a very narrow window while WordPress is unpacking a complete Core update.”
The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under “wp-content/upgrade.” This copy also includes the WordPress installer.
“Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution,” Alex Thomas, who leads the Wordfence Threat Response Team, said.
A threat actor who is able to win the race condition can gain the ability to execute code on the server, assuming the following conditions are met –
- A full-package update containing the installer files
- Public web and PHP access to the staging tree
- A predictable or discovered staging path, and
- Adequate time to complete the attack before WordPress cleans up the temporary files
Although that window has been observed to last only seconds in normal lab environments, threat actors are polling vulnerable paths, such as “setup-config.php,” repeatedly in an attempt to trigger the flaw. Over the past 24 hours, Wordfence said it has blocked 62,969 attacks targeting the vulnerability.
“Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window,” Thomas said. “Other sources tested many staging-directory and version-name variations.”
“Not every request used the exact vulnerable path, but the sustained polling and exact-layout probes show that attackers quickly understood the race condition and began targeting it.”
With active exploitation attempts already underway, WordPress site owners are advised to update to version 7.1.4 as soon as possible and look for suspicious requests to PHP files located under “wp-content/upgrade,” as well as unfamiliar administrator accounts, plugins, or PHP files.
