Cybercriminals have begun targeting a high-severity security vulnerability in WordPress Core shortly after security patches were released, raising concerns for website owners running vulnerable installations.
The vulnerability, which currently has no assigned CVE identifier, affects WordPress Core versions 4.7 through 7.1.3 and could allow unauthenticated attackers to execute malicious code on vulnerable web servers.
The security flaw carries a CVSS score of 8.1, indicating high severity. Patches addressing the issue were released on October 28, 2026.
The vulnerability is associated with predictable and publicly accessible staging directories created during full-package WordPress Core updates. Under specific conditions, attackers can exploit a brief upgrade window to access temporary installation files and execute PHP code without authentication.
How the WordPress Core Vulnerability Works
The security issue stems from the way affected WordPress versions handle full-package Core updates.
During an update, WordPress extracts new installation files into a temporary directory located under:
wp-content/upgrade
This staging directory may contain the WordPress installation files, including the installer script.
On servers where this directory is accessible through the web, attackers may attempt to access the temporary installer while the update process is still running.
If an attacker successfully exploits this timing window, they could interact with the staged WordPress installation and potentially achieve remote code execution on the server.
The vulnerability is particularly concerning because it does not require an authenticated WordPress account.
Race Condition Enables Remote Code Execution
The vulnerability relies on a race condition, a type of security weakness that occurs when an attacker takes advantage of the timing between two or more operations.
In this case, attackers must send requests while WordPress is extracting update files and before the temporary staging directory is removed.
Successful exploitation depends on several conditions:
- A full-package WordPress Core update must include the installer files.
- The staging directory must be publicly accessible through the web server and PHP.
- The attacker must identify or predict the temporary staging path.
- The attacker must successfully send requests before WordPress removes the temporary files.
Although the exploitation window may last only a few seconds under normal laboratory conditions, automated attack tools can repeatedly probe vulnerable websites in an attempt to identify an active upgrade process.
Attackers Launch Thousands of Exploitation Attempts
Security researchers have observed threat actors actively scanning and probing WordPress websites for signs of the vulnerable staging directory.
Attackers are reportedly sending repeated requests to PHP files, including:
setup-config.php
These requests are designed to identify temporary WordPress installation files that may become accessible during a Core update.
During a 24-hour monitoring period, security researchers reported blocking 62,969 attack attempts targeting the vulnerability.
Some attacking sources repeatedly monitored small groups of websites for approximately 14.5 hours, suggesting that they were attempting to identify the brief period during which a vulnerable update process was underway.
Other sources tested multiple staging-directory locations and WordPress version-name variations to discover potentially exposed installation files.
The sustained scanning activity indicates that threat actors quickly identified the underlying race condition and began developing automated methods to target vulnerable installations.
Why This WordPress Security Flaw Is Dangerous
Remote code execution vulnerabilities are among the most serious security threats affecting websites because they can allow attackers to run arbitrary code on the underlying server.
If exploitation succeeds, attackers may potentially:
- Upload malicious PHP files.
- Modify legitimate website files.
- Create unauthorized administrator accounts.
- Install malicious plugins or backdoors.
- Steal sensitive website and database information.
- Establish persistent access to compromised hosting environments.
Because the vulnerability can be exploited without authentication under the required conditions, websites with publicly accessible staging directories may face increased exposure during Core updates.
WordPress Releases Security Patch
WordPress addressed the vulnerability with the release of version 7.1.4 on October 28, 2026.
Website administrators should immediately update affected installations to the patched version to reduce the risk of exploitation.
In addition to updating WordPress Core, administrators should review their websites for signs of suspicious activity.
Recommended security checks include:
- Inspecting web server logs for unusual requests targeting PHP files under
wp-content/upgrade. - Checking for unfamiliar WordPress administrator accounts.
- Reviewing installed plugins and removing unauthorized additions.
- Searching for unexpected or recently modified PHP files.
- Monitoring suspicious server-side processes and file changes.
- Ensuring temporary upgrade directories are not publicly accessible.
Website owners should also keep WordPress themes, plugins, and server-side software updated to reduce the risk of additional security compromises.
WordPress Website Owners Urged to Update Immediately
The active exploitation attempts demonstrate how quickly cybercriminals can respond when a new vulnerability becomes publicly known.
Although the race condition requires precise timing, automated scanning and repeated requests can increase attackers’ chances of identifying vulnerable upgrade windows.
Organizations operating WordPress websites should prioritize installing the latest security updates and reviewing server logs for suspicious activity.
With thousands of exploitation attempts already reported, delaying security updates could leave vulnerable websites exposed to unauthorized access and potential server compromise.
