// AI threat desk · 2 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalRCECVSS 9.2 / 8.1 / 4.7

WordPress Core flaw targeted after 7.1.4 release

Attackers attempted to exploit a WordPress Core remote code execution flaw affecting versions 4.7 through 7.1.3 after the Oct 28, 2026, patch release. The Hacker News disclosed the activity.

· 2 min read
AI-generated image of security analysts monitoring blurred website security dashboards in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • HKCERT said WordPress released version 7.1.4 on Oct 28, 2026, addressing 22 security vulnerabilities.
  • The flaw could allow an unauthenticated attacker who wins the extraction race to reach remote code execution.
  • Wordfence said it blocked 62,969 attacks targeting the vulnerability over 24 hours.

WordPress released patches on Oct 28, 2026, after attackers attempted to exploit a WordPress Core remote code execution flaw, The Hacker News said. The vulnerability has no CVE identifier.

The issue affects WordPress Core versions 4.7 through 7.1.3. An unauthenticated attacker who wins a race while WordPress extracts a complete update could reach remote code execution on the server.

WordPress is a free, open-source web content management system used for websites, forums, media galleries, membership sites, learning platforms and online stores. It was used by 22.52% of the top one million websites as of December 2024.

On this page

WordPress exposed a web-accessible update staging path

During a complete-package core update, WordPress extracted new files into a predictable directory inside the web-served upgrade folder. Wordfence said the flaw resulted from predictable, web-accessible staging paths used during full-package core upgrades.

The attack requires a narrow timing window while WordPress unpacks a complete core update. The Hacker News said that window lasted only seconds in normal laboratory environments.

WordPress 7.1.4 closes the race-condition flaw

HKCERT said the update closes the code execution weakness alongside stored cross-site scripting, information disclosure and permission issues. The official WordPress announcement credited researcher Umut Bayram with reporting the upgrade flaw.

HKCERT said administrators can also restrict public web access to wp-content/upgrade/ as added protection.

Monitoring recorded attempted requests against the flaw

Wordfence said it blocked 62,969 attacks targeting the vulnerability over 24 hours. Alex Thomas said two major sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window.

The Hacker News said the flaw was targeted shortly after patches were released. It also said administrators should inspect wp-content/upgrade for suspicious PHP requests, unfamiliar administrator accounts, plugins or PHP files.

WordPress said the fix in version 7.1.4 was backported to every branch back to 4.7.

HKCERT said free users are scheduled to receive the related firewall rule on Nov 27, following a standard 30-day delay. Premium, Care and Response customers received a rule on Oct 28, roughly three hours after the release.

What to do now

  1. Update to version 7.1.4 as soon as possible.
  2. Open the Dashboard, select Updates, and confirm that WordPress 7.1.4 is installed.

FAQ

What happened to WordPress Core?

The Hacker News said attackers attempted to exploit a remote code execution flaw shortly after patches were released on Oct 28, 2026. It said the vulnerability has no CVE identifier.

Which WordPress versions are affected?

The Hacker News said the vulnerability affects WordPress Core versions 4.7 through 7.1.3. WordPress said the fix was backported to branches back to 4.7.

Can the WordPress flaw be exploited without logging in?

WordPress said an unauthenticated attacker who wins a race against update-file extraction could reach remote code execution.

How do I fix the WordPress Core flaw?

The Hacker News said to update to version 7.1.4 as soon as possible. HKCERT said administrators should open the Dashboard, select Updates and confirm that WordPress 7.1.4 is installed.

How does the WordPress vulnerability work?

WordPress said that during a complete-package core update, it extracted files into a predictable directory inside the web-served upgrade folder. The Hacker News said an attacker must hit a narrow window while WordPress is unpacking the update.

Sources

  1. Over 60,000 Attacks Target WordPress RCE Vulnerability Within 24 Hours, HKCERTPrimary
  2. A race condition during core updates that could lead to remote code execution, GitHubPrimary
  3. WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours, The Hacker News
  4. WordPress Remote Code Execution Vulnerability Sees Almost 63,000 Attack Attempts Within 24 Hours, RS Web Solutions
  5. WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution, TechRepublic
  6. WordPress, Wikipedia
How we checked this story
ClaimSourceStatus
The Hacker News said threat actors attempted to exploit a high-severity WordPress Core security flaw shortly after patches were released.The Hacker NewsAttributed
The Hacker News said the vulnerability affects WordPress Core versions 4.7 through 7.1.3 and has no CVE identifier.The Hacker NewsAttributed
The Hacker News said the vulnerability carries a CVSS score of 8.1.The Hacker NewsAttributed
The Hacker News said wordPress released patches for the flaw on October 28, 2026.The Hacker NewsAttributed
Wordfence said the flaw results from predictable, web-accessible staging paths during complete WordPress Core upgrades.Wordfence, via The Hacker NewsAttributed
Wordfence said unauthenticated attackers can execute code on the server during the upgrade window.Wordfence, via The Hacker NewsAttributed
Wordfence said it blocked 62,969 attacks targeting the vulnerability over 24 hours.Wordfence, via The Hacker NewsAttributed
HKCERT said wordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities.HKCERTAttributed
HKCERT said the update closes the code execution weakness alongside stored cross-site scripting, information disclosure, and permission issues.HKCERTAttributed
HKCERT said premium, Care, and Response customers received a firewall rule on October 28, roughly three hours after release.HKCERTAttributed
HKCERT said free users are scheduled to receive the firewall rule on November 27 after the standard 30-day delay.HKCERTAttributed
The Hacker News said administrators should inspect wp-content/upgrade for suspicious PHP requests, unfamiliar administrator accounts, plugins, or PHP files.The Hacker NewsAttributed
WordPress 7.1.4 fixes the race-condition vulnerability, and the fix was backported to every branch back to 4.7.WordPress, via GitHubConfirmed
During a complete-package core update, WordPress extracted new files into a predictable directory inside the web-served upgrade folder.WordPress, via GitHubConfirmed
An unauthenticated attacker who wins the race against extraction can reach remote code execution.WordPress, via GitHubConfirmed
HKCERT said site owners should restrict public web access to wp-content/upgrade as additional protection.HKCERTAttributed
WordPress was used by 22.52% of the top one million websites as of December 2024.WikipediaConfirmed
TechRepublic said wordPress assigned the vulnerability a 9.2 CVSS v4.0 score and classified it as critical.TechRepublicAttributed

Could not verify

  • Whether any website was successfully compromised is not established
  • How many individual websites were targeted is not established
  • Whether the attack attempts resulted in remote code execution is not established
HKCERT
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok