WordPress RCE flaw draws 62,969 attack attempts despite patch

Wordfence reported on Oct. 30, 2026, that it blocked 62,969 exploit attempts targeting a WordPress remote code execution vulnerability in the first 24 hours of detecting the attack campaign. Defiant stated on Oct. 30, 2026, that the vulnerability has no assigned CVE identifier and affects WordPress Core versions 4.7 through 7.1.3, and carries an 8.1 CVSS score. Techaeris reported that researcher Umut Bayram discovered the flaw, and WordPress released version 7.1.4 on Oct. 28, 2026, to patch it.

The vulnerability stems from a race condition in web-accessible staging paths during full-package core updates, according to Defiant, which stated this on Oct. 30, 2026. Unauthenticated attackers can request the installer during this staging window to gain PHP code execution, as Alex Thomas, who leads the Wordfence Threat Response Team, explained on Oct. 30, 2026. The staging directory remains accessible for only seconds before cleanup, making the exploit window narrow but still exploitable with precise timing. Successful exploitation depends on precise timing, public web and PHP access to the staging tree, and the presence of installer files.

“This is due to predictable, web-accessible staging paths used during full-package core upgrades,” Wordfence stated on Oct. 30, 2026. Attackers repeatedly poll vulnerable paths like setup-config.php to catch this brief window, Wordfence observed.

Wordfence detected two major attack sources repeatedly scanning small groups of sites for 14.5 hours, probing for the upgrade window to exploit the flaw. The first exploit attempt was detected nine minutes after Wordfence’s firewall rule was deployed, with over 18,500 requests targeting staged setup-config.php paths in the first 21 hours.

Wordfence’s telemetry showed sustained polling behavior, indicating attackers understood the narrow exploit window and were systematically targeting predictable staging paths like setup-config.php during WordPress updates, exploiting a race condition where the staging directory remains accessible for seconds.

WordPress 7.1.4 patches the RCE flaw by randomizing the staging directory, adding an index guard, and blocking unsafe promotion of staged configuration data. WordPress backported the fixes to versions as old as 4.7, though versions 4.6 and earlier no longer receive security updates.

This means older installations on unsupported branches remain vulnerable unless manually updated, increasing their risk of exploitation. The patch addresses the core issue of predictable, web-accessible staging paths during updates, which attackers exploited to execute code. WordPress also updated bundled root certificates following the revocation of eMudhra, a digital certificate authority. This update ensures compatibility with current certificate validation standards, addressing a potential security risk in older installations.

BleepingComputer reported on July 18, 2026, that public exploits for wp2shell remote code execution vulnerabilities combining CVE-2026-63030 and CVE-2026-60137 in WordPress Core versions 6.9 and 7.0 appeared. TechRepublic reported on Sept. 25, 2026, that attackers targeted CVE-2026-87902, an unauthenticated path traversal vulnerability in WordPress Core page-template resolution carrying a 9.2 CVSS score.

According to Techaeris on Oct. 30, 2026, version 7.1.4 also resolves 21 security issues beyond the RCE flaw. Techaeris reported that the update covers username handling, personal data erasure requests, stored XSS issues in block delimiters, the Customizer, comment pagination labels, and the Categories block.

Defiant stated on Oct. 30, 2026, that the vulnerability has no assigned CVE identifier. Wordfence has recorded no successful compromises resulting from the latest WordPress RCE vulnerability. The lack of confirmed breaches suggests the exploitability window is narrow and difficult to exploit successfully, though the risk remains for unpatched systems.

Alex Thomas noted that blocking HTTP access to the wp-content/upgrade directory before starting an update is a safer approach, while acknowledging the tension between immediate patching and server-level configuration. Thomas argued that delaying updates to configure path blocks might leave users exposed longer, while admins with server control should ideally block the directory before updating.

WordPress recommends confirming the updated version in Dashboard > Updates rather than assuming automatic updates have applied successfully. WordPress advises administrators to audit the wp-content/upgrade directory for suspicious PHP files and unfamiliar administrator accounts, plugins, or files post-update, which helps detect signs of exploitation such as unauthorized file modifications or new accounts created during the attack window. This advice ensures administrators verify patch application, especially for sites with automatic updates enabled.

Wordfence’s firewall rule for blocking the RCE attacks was deployed three hours after the WordPress 7.1.4 patch release. Free users of the service will receive the rule on November 27, 2026. Wordfence also recommends enabling Extended Protection to block direct requests to staged PHP files. The delay leaves free users exposed for an extended period, increasing the risk of exploitation during the 30-day window.