WordPress core RCE flaw sees over 58,000 blocked exploit attempts
CRITICAL · VULNERABILITYWordPressredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
An unauthenticated remote code execution flaw in WordPress Core is under active exploitation, with Wordfence reporting 58,693 blocked attempts in 24 hours; the article does not confirm successful compromises. The flaw is described as exploitable during a brief window while sites are being updated. WordPress 7.1.4, released 28 October 2026, addresses 22 security vulnerabilities, but no CVE identifier is given in the supplied text. Defenders should update WordPress core to 7.1.4 as a priority, review web server and WAF logs for exploitation attempts, and check sites for signs of unauthorised code or new admin accounts.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update WordPress core to version 7.1.4 or later as soon as possible.
- Review web server and firewall logs for exploitation attempts against WordPress sites.
- Check WordPress installations for unexpected files, users or admin accounts.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Products