Word Press RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Summary: Wordfence blocked 62,969 attack attempts against a high-severity WordPress Core remote code execution flaw, CVSS 8.1, with no CVE identifier, affecting versions 4.7 through 7.1.3, for which patches were released on October 28, 2026. The flaw stems from full-package Core upgrades unpacking files, including the WordPress installer, into a predictable web-accessible directory under wp-content/upgrade, letting unauthenticated attackers who hit the brief upgrade window progress to PHP code execution.
What you should know: Two of the largest attack sources polled small groups of sites for roughly 14.5 hours to catch an upgrade window that lasts only seconds, so the exposure is not a theoretical race but one attackers are already running at scale against unpatched WordPress Core installs.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026