{"id":3896,"date":"2026-10-30T18:06:00","date_gmt":"2026-10-30T18:06:00","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3896"},"modified":"2026-10-30T18:06:00","modified_gmt":"2026-10-30T18:06:00","slug":"wordpress-rce-flaw-draws-nearly-63000-attack-attempts-in-just-24-hours","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3896","title":{"rendered":"WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 30, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.<\/p>\n

The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released<\/a> on October 28, 2026.<\/p>\n

\u00abThis is due to predictable, web-accessible staging paths used during full-package core upgrades,\u00bb Wordfence said<\/a>. \u00abThis makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.\u00bb<\/p>\n

The WordPress security company noted that successful exploitation requires an \u00abattacker to hit a very narrow window while WordPress is unpacking a complete Core update.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under \u00abwp-content\/upgrade.\u00bb This copy also includes the WordPress installer.<\/p>\n

<\/p>\n

\u00abBecause the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution,\u00bb Alex Thomas, who leads the Wordfence Threat Response Team, said.<\/p>\n

A threat actor who is able to win the race condition can gain the ability to execute code on the server, assuming the following conditions are met –<\/p>\n