Do Son 
TL;DR
Wordfence warned on October 29, 2026, that threat actors are actively exploiting a critical WordPress Core vulnerability in the wild. The flaw affects versions 4.7 through 7.1.3 and allows unauthenticated attackers to execute arbitrary code during core upgrades. Website administrators must upgrade their sites to WordPress 7.1.4 or their branch security release immediately.
Why It Matters
WordPress powers over 43 percent of all websites on the internet, according to market data from W3Techs. This footprint represents an estimated 500 million active websites globally. Consequently, an unauthenticated flaw in WordPress Core creates immense exposure across the web.
Wordfence researchers confirmed active exploitation in the wild shortly after the release. Specifically, Wordfence noted that “Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability.” The security firm recorded over 18,500 malicious requests targeting staged installer paths within 21 hours. Furthermore, no working public proof-of-concept exploit code has been confirmed, and MITRE has not yet assigned an official CVE identifier.
How the Attack Works
The vulnerability stems from predictable, web-accessible staging paths used during full-package core upgrades. Researcher Umut Bayram discovered the issue, which carries a CVSS score of 8.1.
The Wordfence security advisory explains: “WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3.” The report adds: “This is due to predictable, web-accessible staging paths used during full-package core upgrades.”
The Upgrade-Window Race Condition
When WordPress processes a complete core update, it unpacks files into a predictable directory beneath wp-content/upgrade. This temporary folder includes the WordPress installer scripts.
Because many servers expose the staging directory to the web, an unauthenticated attacker can request the staged setup-config.php file. If the attacker accesses the file during unpacking, they can execute PHP code on the server.
However, the attack requires precise timing. As Wordfence observed, “In lab environments, the vulnerable staging directory normally remained available for only seconds.” To win this race condition, threat actors deploy automated scripts that poll target sites repeatedly during upgrade windows.
Other Security Flaws in the Release
The update also addresses 21 other vulnerabilities, as detailed in the official WordPress 7.1.4 documentation. These include multiple stored cross-site scripting bugs in the block editor and Interactivity API flaws.
Affected Versions
This WordPress Core vulnerability affects WordPress versions 4.7 through 7.1.3 when performing full-package upgrades. WordPress versions 4.6 and earlier do not receive security updates and remain insecure.
Patch and Mitigation Steps
WordPress resolved the race condition in version 7.1.4 by randomizing the staging directory and adding index protection. The security team also backported the fix to branches down to version 4.7.
Site owners should navigate to Dashboard, click Updates, and confirm that their installation runs WordPress 7.1.4. Administrators should also optimize endpoint firewalls with extended protection to filter direct requests to PHP files. Additionally, server administrators can deny public web access to the wp-content/upgrade directory at the web server configuration level.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
