CONNECT WITH US
Cyber Security

Cyber Security

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

The Hacker News logo

Published on

Add as a preferred source on Google
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.

The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026.

"This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said. "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."

The WordPress security company noted that successful exploitation requires an "attacker to hit a very narrow window while WordPress is unpacking a complete Core update."

The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under "wp-content/upgrade." This copy also includes the WordPress installer.

"Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution," Alex Thomas, who leads the Wordfence Threat Response Team, said.

A threat actor who is able to win the race condition can gain the ability to execute code on the server, assuming the following conditions are met -

php," repeatedly in an attempt to trigger the flaw. Over the past 24 hours, Wordfence said it has blocked 62,969 attacks targeting the vulnerability.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.