WordPress RCE Vulnerability Targeted in Nearly 63,000 Attacks Within 24 Hours

Cybersecurity researchers have reported a surge in exploitation attempts targeting a high-severity remote code execution (RCE) vulnerability in WordPress Core, with security company Wordfence blocking 62,969 attack attempts within just 24 hours.

The vulnerability, tracked as CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3 and carries a CVSS severity score of 8.1.

The security weakness could allow unauthenticated attackers to execute malicious PHP code on vulnerable servers during a brief period when WordPress performs certain core software updates.

WordPress released security patches on October 28, 2026, but attackers quickly began scanning websites for opportunities to exploit the flaw.

How the WordPress Vulnerability Works

The vulnerability originates from a race condition in the WordPress Core update mechanism.

During a full-package software update, affected WordPress versions temporarily extract installation files into a predictable directory under wp-content/upgrade.

This temporary location can become accessible through the web server, potentially exposing installation components before the update process finishes.

An attacker who accesses the vulnerable installation files at precisely the right moment may be able to execute unauthorized PHP code on the server.

Successful exploitation requires several conditions, including an ongoing full-package update, an accessible staging directory and precise timing.

Researchers observed that the vulnerable window generally lasts only a few seconds under laboratory conditions.

However, automated attack tools can repeatedly request vulnerable paths, increasing the possibility of reaching the temporary files during an update.

Nearly 63,000 Attacks Detected in One Day

Wordfence reported blocking 62,969 requests associated with exploitation attempts over a 24-hour period.

Researchers observed attackers repeatedly probing installation-related PHP files, including setup-config.php, within WordPress upgrade directories.

Two major attack sources continuously targeted relatively small groups of websites for approximately 14.5 hours.

Other sources scanned different directory structures and WordPress version combinations.

This activity suggests that attackers were attempting to identify websites undergoing vulnerable software updates.

The reported figure represents blocked exploitation attempts, not 62,969 confirmed successful website compromises.

Affected WordPress Versions

The vulnerability affects multiple WordPress Core releases, including:

• WordPress 7.1.0 through 7.1.3
• WordPress 7.0.0 through 7.0.7
• Earlier vulnerable releases dating back to WordPress 4.7

The primary security fix is included in WordPress 7.1.4.

Security patches have also been backported to older branches, including versions 7.0.8, 6.9.11 and other corresponding maintenance releases.

Administrators should verify that their websites are running a patched version appropriate to their installed branch.

WordPress Releases Emergency Security Updates

WordPress 7.1.4 addresses the vulnerable upgrade process by strengthening the handling of temporary installation files.

The update introduces additional protections to reduce the risk of attackers accessing staged installation components.

The security release also addresses several other vulnerabilities, including stored cross-site scripting, information disclosure and denial-of-service issues.

WordPress administrators are strongly encouraged to install the latest security updates rather than relying exclusively on firewall protections.

Security Recommendations for WordPress Administrators

Organizations operating WordPress websites should take the following precautions:

1. Update WordPress Core: Install version 7.1.4 or the appropriate patched release for the existing branch.
2. Protect upgrade directories: Restrict unnecessary public access to temporary WordPress installation files, particularly while applying updates.
3. Review web server logs: Investigate suspicious requests targeting PHP files within wp-content/upgrade.
4. Check for unauthorized changes: Identify unfamiliar administrator accounts, unexpected plugins and suspicious PHP files.
5. Enable web application firewall protection: Use properly configured WAF rules to detect and block exploitation attempts.
6. Perform security scans: Review WordPress Core integrity and investigate potentially malicious modifications.
7. Maintain backups: Ensure website files and databases are backed up before major updates.

Administrators should also verify that protective controls are active before beginning an update, since the vulnerability is associated with the update process itself.

Security Takeaway

The rapid exploitation attempts targeting WordPress demonstrate how quickly cybercriminals can react to newly disclosed vulnerabilities.

Although successful exploitation requires precise timing, automated scanning enables attackers to repeatedly probe websites until a vulnerable update window becomes available.

The incident reinforces the importance of secure update mechanisms, timely patch management and continuous monitoring of internet-facing applications.

WordPress administrators should immediately verify their security patch status and investigate suspicious activity involving temporary upgrade directories.