Threat actors began attempting to exploit a high-severity WordPress Core vulnerability shortly after patches shipped on 28 October 2026, with Wordfence recording close to 63,000 attack attempts within 24 hours. The flaw — which has no CVE identifier — is a remote-code-execution issue affecting WordPress Core versions 4.7 through 7.1.3 and carries a CVSS score of 8.1. Wordfence said it stems from predictable, web-accessible staging paths used during full-package core upgrades: affected versions unpack new files, including the installer, into a predictable directory under wp-content/upgrade, so an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged copy and progress to PHP code execution. Successful exploitation requires hitting "a very narrow window while WordPress is unpacking a complete Core update," making it a race condition, but the attempt volume shows widespread automated probing against a platform powering a large share of retail and small-business sites. Administrators should confirm Core is updated and restrict access to the upgrade directory.

• Source article