Hackers flooded WordPress sites with tens of thousands of requests targeting a Core remote code execution (RCE) weakness in the hours after a security patch was released. Wordfence’s threat intelligence recorded 60,471 blocked attempts in a 24‑hour window — a clear signal that attackers were actively probing the update process, even though the majority of those requests were firewall‑blocked and not confirmed compromises.
What attackers were trying to exploit
The flaw is a race condition that can briefly expose a temporary installation directory during a full WordPress Core upgrade. During updates WordPress extracts files into a staging folder; predictable folder names and publicly accessible installation files can allow an attacker who reaches that temporary installer to connect it to a database they control. Unlike vulnerabilities that require stolen credentials or an existing account, this one could be targeted without logging in. The attack window typically lasts only seconds, so exploitation is difficult but possible if attackers repeatedly probe a site during its upgrade.
How the 7.1.4 patch fixes the problem
WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities including this RCE. The patch hardens the update process by adding 16 random characters to temporary folder names, restoring protective index.php handling, and preventing wp-config.php from being copied from the working directory. These changes mitigate exposure in the staging process itself rather than addressing a third‑party plugin.
Firewall response and what the numbers mean
The high number of blocked requests reported by Wordfence shows active testing by attackers, but it does not equate to thousands of successful compromises. The advisory explicitly distinguishes between requests blocked by a firewall and successful code execution. Wordfence rolled out a firewall rule for Premium, Care, and Response customers about three hours after the release; free users were scheduled to receive the rule on November 27 under the standard 30‑day delay. Administrators should not rely on an incoming firewall rule before installing the patch.
Versions and support considerations
The official version documentation lists patched releases and backports, including 7.0.8 and 6.9.11, with backports extending through 4.7.39. WordPress versions 4.6 and earlier no longer receive security updates, so administrators on older branches need to follow the corresponding security releases or plan upgrades to supported versions.
Practical steps for site owners
Site owners should open the Dashboard, go to Updates, and confirm WordPress 7.1.4 (or the correct patched branch) is installed. Automatic background updates may deliver the release on supported configurations, but verification is essential rather than assuming protection. As an added precaution, administrators can restrict public web access to wp-content/upgrade/ because a plugin firewall alone may not cover an extracted installer that loads separately from the main site. Applying the Core security update remains the central fix.
Why speed matters
The exploit’s race‑condition nature means attackers gain advantage through volume and timing: repeated requests increase the chance of hitting a site at the fleeting moment its update files are exposed. The Wordfence data demonstrates that attackers test such timing‑dependent weaknesses in the wild even when exploitation is nontrivial.
Closing perspective
The episode underlines a simple reality: timely patching of Core updates is critical, and firewall rules are a helpful layer but not a substitute for installing the security release. The reported 60,471 attempts reveal active exploitation attempts, but site owners control their risk most directly by installing 7.1.4 (or the correct patched branch) and confirming protections are in place.
Licensed under CC BY-ND 4.0 International