WordPress RCE probes target brief core update window
WordPress RCE exploitation attempts are targeting a short-lived opportunity created while affected sites install full Core updates. Remote code execution (RCE) is a vulnerability impact that can let an attacker run software commands on the website's server. Wordfence reports that it blocked 62,969 attempts aimed at this issue during a 24-hour period, shortly after patches became available.
The high-severity flaw affects WordPress Core versions 4.7 through 7.1.3. WordPress Core is the main software that operates a WordPress website, separate from its installed themes and plugins. The issue has a Common Vulnerability Scoring System (CVSS) score of 8.1. CVSS is a standard scale used to describe the seriousness of a security weakness. No Common Vulnerabilities and Exposures (CVE) identifier has been assigned. Patches were released on October 28, 2026, and site owners are advised to update to WordPress 7.1.4 as soon as possible.
Wordfence attributes the vulnerability to predictable temporary locations used during a full-package Core update. In this kind of update, WordPress unpacks a complete set of new files into a staging directory, which is a temporary folder used before installation is finished. Affected versions place those files beneath the web-accessible path "wp-content/upgrade." The staged copy also contains the WordPress installer.
If that temporary directory can be reached through the public web, an unauthenticated attacker, meaning someone who has not signed in, can request the staged installer at precisely the right moment. The attacker may then interact with the temporary WordPress copy and progress to executing PHP code. PHP is the programming language used to run much of WordPress on a server. The opportunity normally exists only while the complete update is being unpacked and before WordPress removes the temporary files.
Successful exploitation therefore depends on several conditions occurring together. The update must be a full package containing the installer files. The temporary directory must permit public web access and allow PHP execution. Its location must be predictable or otherwise discovered, and the attacker must have enough time to complete the process before cleanup. Wordfence describes this as a race condition, where success depends on reaching a resource during a brief and precisely timed state.
In normal laboratory environments, Wordfence observed that this window lasted only seconds. Attackers are compensating for that limitation by repeatedly polling vulnerable locations, including "setup-config.php," in an effort to catch a site while it is updating. Two of the largest sources repeatedly checked small groups of websites for about 14.5 hours. Other sources tried numerous staging-directory layouts and version-name variations.
Not every request used the exact path needed to exploit the flaw. However, Wordfence said the prolonged polling and probes for precise directory layouts indicate that attackers had understood the timing problem and were actively trying to exploit it. The reported 62,969 figure represents blocked attempts, not a count of confirmed website compromises. A request also has to coincide with the narrow update window and satisfy the other conditions before code execution can occur.
Website owners should install WordPress 7.1.4 and review server activity for suspicious requests to PHP files beneath "wp-content/upgrade." They should also inspect their sites for administrator accounts, plugins or PHP files they do not recognise, since those may warrant further investigation. Owners who cannot examine website files or request records themselves can ask their hosting provider or site administrator to perform those checks.
For owners considering a managed service, AEU Hosting provides managed WordPress hosting, secured end to end. Regardless of how a site is operated, applying WordPress 7.1.4 promptly and checking for the indicators identified by Wordfence are the direct actions relevant to this vulnerability.