Over 60,000 blocked attacks target WordPress core code execution flaw
VULNERABILITYWordPressredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
WordPress 7.1.4, released on 28 October 2026, fixes 22 vulnerabilities, including a race-condition remote code execution flaw in the core upgrade process. Wordfence logged 60,471 blocked exploitation attempts over 24 hours, though these are attempts rather than confirmed compromises. Administrators should update, verify that the update completed, and consider restricting public access to wp-content/upgrade/.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Update WordPress to version 7.1.4, or to the patched branch for your version such as 7.0.8 or 6.9.11.
- Check under Dashboard and Updates that the update has actually completed rather than assuming automatic updates worked.
- Restrict public web access to wp-content/upgrade/ as an additional safeguard.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Products