Ethical Hacking News
WordPress Core security flaw sparks 63,000 attack attempts in 24 hours, highlighting the importance of timely software updates and proactive security measures. Read the full story to learn more about the vulnerability and how to protect your website.
WordPress Core has a high-severity security flaw that drew nearly 63,000 attack attempts in 24 hours. The vulnerability, which affects versions 4.7 through 7.1.3, carries a critical CVSS score of 8.1 and enables remote code execution. The flaw can be exploited by attackers who can hit a narrow window while WordPress is unpacking a complete Core update. Threat actors have been polling vulnerable paths repeatedly to trigger the flaw, with 62,969 attacks blocked by Wordfence in the past 24 hours. Website owners should update to the latest version of WordPress Core (7.1.4) and monitor for suspicious requests to PHP files under \"wp-content/upgrade.\"
The latest security news has revealed a shocking case of a high-severity security flaw in WordPress Core, which has drawn nearly 63,000 attack attempts in just 24 hours. This alarming development highlights the importance of timely software updates and the need for website owners to remain vigilant in the face of emerging threats.
According to recent reports, the vulnerability in question relates to a case of remote code execution, impacting WordPress Core versions 4.7 through 7.1.3. This flaw carries a critical CVSS score of 8.1, indicating a high level of risk to affected websites. Patches for the flaw were released on October 28, 2026, but the speed at which threat actors were able to exploit this vulnerability suggests that many website owners may have overlooked the importance of updating their software in a timely manner.
The vulnerability in question can be attributed to predictable, web-accessible staging paths used during full-package core upgrades. According to Wordfence, a prominent WordPress security company, this makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. The staging directory is web-accessible on many servers, providing an attractive target for threat actors seeking to exploit this vulnerability.
In order to successfully exploit this vulnerability, an attacker must be able to hit a very narrow window while WordPress is unpacking a complete Core update. The staging directory contains the WordPress installer, which can be interacted with by an attacker who requests the installer at precisely the right moment. This allows the attacker to progress to PHP code execution, assuming they can meet certain conditions, including:
A full-package update containing the installer files
Public web and PHP access to the staging tree
A predictable or discovered staging path
Adequate time to complete the attack before WordPress cleans up the temporary files
While the window for exploiting this vulnerability may be short, lasting only seconds in normal lab environments, threat actors have been polling vulnerable paths, such as "setup-config.php," repeatedly in an attempt to trigger the flaw. In the past 24 hours, Wordfence has blocked 62,969 attacks targeting the vulnerability, with two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window.
The sustained polling and exact-layout probes demonstrate that attackers quickly understood the race condition and began targeting it. This highlights the importance of website owners taking proactive steps to secure their sites, such as updating to the latest version of WordPress Core (7.1.4) as soon as possible, and monitoring for suspicious requests to PHP files located under "wp-content/upgrade," as well as unfamiliar administrator accounts, plugins, or PHP files.
In addition to the immediate steps that website owners can take to protect their sites, this incident also underscores the need for software companies to prioritize the development of robust security patches and the importance of keeping their users informed about potential vulnerabilities. By working together, we can minimize the impact of these types of attacks and ensure that the online community remains safe.
Related Information:
https://www.ethicalhackingnews.com/articles/WordPress-Core-Security-Flaw-Sparks-63000-Attack-Attempts-in-24-Hours-ehn.shtml
https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html
Published: Fri Oct 30 12:31:26 2026 by llama3.2 3B Q4_K_M
