Over 60,000 blocked attacks target WordPress core code execution flaw
- Severity
- High
- Sources
- 1
What happened
WordPress 7.1.4 (28 October 2026) addresses 22 vulnerabilities, including a race-condition RCE during core upgrades: update files are extracted to a predictable temporary staging directory where a separate installer can be briefly exposed and pointed at an attacker-controlled database. Wordfence reports 60,471 blocked requests in 24 hours, which measure attack activity rather than successful compromises. Patched branches include 7.0.8, 6.9.11 and backports to 4.7.39; 4.6 and earlier are unsupported. Verify 7.1.4 is installed, and restrict public access to wp-content/upgrade/ as added protection, since plugin firewalls may not cover the extracted installer.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update WordPress to version 7.1.4, or to the patched branch for your version such as 7.0.8 or 6.9.11.
- Check under Dashboard and Updates that the update has actually completed rather than assuming automatic updates worked.
- Restrict public web access to wp-content/upgrade/ as an additional safeguard.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products