A recent vulnerability in WordPress Core has become the focus of intense cyberattack activity, with over 60,000 attempts recorded within a day of a new patch's release. The vulnerability, which was addressed by the WordPress 7.1.4 update released on October 28, 2026, involves a remote code execution flaw that could potentially expose websites during software updates. This issue arises from a race condition during the update process, whereby attackers can exploit temporary installation files if they manage to access them at precisely the right moment. While these attempts have been logged by Wordfence, it is important to note that they represent blocked efforts rather than successful breaches.
The update not only patched the code execution vulnerability but also addressed other security concerns like cross-site scripting, information disclosure, and permissions issues. Security researcher Umut Bayram was credited with identifying the flaw, which allows attackers to connect a temporary WordPress installer to a database they control, potentially leading to code execution on the server. The attack opportunity exists only for a few seconds, making successful exploitation challenging but not impossible.
WordPress administrators are strongly urged to update to version 7.1.4 immediately. The patch adds random characters to temporary folder names and restores protective measures to prevent unauthorized file access during updates. Wordfence has already provided enhanced firewall rules to Premium, Care, and Response customers, while free users will receive these protections after a 30-day delay.
Administrators should manually verify that their sites have been updated to the latest version. This includes checking the WordPress Dashboard and ensuring that automatic updates have been correctly applied. Additionally, restricting access to certain directories like wp-content/upgrade/ can offer an extra layer of security. While plugin firewalls may not fully protect against this type of vulnerability, applying the core security update is the most effective defense.
