Hackers Actively Exploiting WordPress RCE Flaw Hours After Patch Release
A critical unauthenticated remote code execution vulnerability in WordPress has been actively exploited by attackers within hours of a patch being released, highlighting the ongoing threat to the popular CMS.
WordPress administrators are urged to update their sites immediately following the discovery of active exploitation attempts targeting a critical remote code execution (RCE) vulnerability. The flaw, affecting WordPress Core versions 4.7 through 7.1.3, was patched in version 7.1.4, released on October 28, 2026. However, threat actors began exploiting the vulnerability within hours of the patch's availability, demonstrating the persistent and rapid nature of cyber threats.
According to a threat report from Wordfence, its firewall detected over 18,500 requests targeting temporary installer paths within the first 21 hours of monitoring. While these requests indicate active exploitation, the exact number of successful breaches remains unconfirmed. The vulnerability carries a CVSS severity score of 8.1, classifying it as high severity.
The vulnerability was reported by researcher Umut Bayram and involves a weakness in the WordPress update process. During a full package update, affected WordPress installations unpack installer files into a predictable, publicly accessible folder located under wp-content/upgrade. If server configurations allow public access and PHP execution in this temporary directory, attackers can exploit a narrow window of opportunity to execute malicious code before WordPress cleans up the staged files.
Successful exploitation hinges on precise timing. In laboratory tests conducted by Wordfence, the temporary folder was only available for a matter of seconds. Attackers must quickly locate the correct path and execute their exploit within this brief period. The pattern of repeated requests observed by Wordfence suggests attackers are attempting to catch this fleeting vulnerability window, although not all requests necessarily targeted a valid vulnerable path.
This RCE flaw differs from other WordPress vulnerabilities due to its specific timing requirements. Unlike some other code execution bugs that might require administrative privileges or specific user roles, this exploit targets a transient state during the update process. This makes it particularly challenging to defend against without timely patching.
The patch, implemented in WordPress 7.1.4, addresses the vulnerability by randomizing the staging folder, adding an index guard, and improving the handling of staged configuration data. WordPress also released fixes for older, still-supported branches down to version 4.7. Administrators can verify their current version by navigating to Dashboard > Updates.
Wordfence has deployed firewall rules to protect its users, with Premium, Care, and Response customers receiving immediate protection, while free users are scheduled to receive the update on November 27, 2026. The company recommends enabling Extended Protection for sites using Wordfence, which loads the firewall before PHP files are executed, offering a more robust defense against direct file access attacks.
Beyond this specific RCE flaw, the WordPress 7.1.4 release also includes fixes for stored cross-site scripting, information disclosure, and permission issues. Promptly updating WordPress Core is crucial not only to mitigate this actively exploited vulnerability but also to maintain overall site security against a wide range of threats.