WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.

The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026.

"This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said. "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."

The WordPress security company noted that successful exploitation requires an "attacker to hit a very narrow window while WordPress is unpacking a complete Core update."

The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under "wp-content/upgrade." This copy also incl