Last Updated on November 1, 2026 by Editorial
If you run a WordPress site, check your version today. A remote code execution flaw in WordPress core is under active attack, and attackers started probing sites almost as soon as the fix became public.
What Was Fixed
WordPress 7.1.4 shipped on October 28, 2026 as a security release, and one of its fixes addresses a remote code execution weakness in the upgrade process. The weakness was reported to the WordPress security team by researcher Umut Bayram.
The vulnerability has no CVE identifier and a CVSS score of 8.1. It affects WordPress Core versions 4.7 through 7.1.3, so a very large share of installations is potentially exposed.
How the Attack Works
According to Wordfence, the problem lies in predictable, web-accessible staging paths used during full-package core upgrades. An unauthenticated attacker who requests the installer at exactly the right moment can interact with the staged copy of WordPress and progress to PHP code execution.
The attack window is narrow. In lab conditions it lasts only seconds, but attackers are repeatedly polling paths such as setup-config.php to catch it. The flaw also stands out because almost every other fix in 7.1.4 requires a logged-in account, while this race condition can lead to code execution without logging in.
Attacks Began Within Hours
Exploitation started quickly. Defiant, the company behind Wordfence, reported that the first match for its new firewall rule arrived nine minutes after deployment, and it recorded more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours.
Later reporting says Wordfence has blocked 62,969 attacks aimed at the flaw over 24 hours. Wordfence has not reported any successful compromises.
What the Patch Changes
WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data. The security team also backported fixes to eligible older branches, extending through WordPress 4.7.
What You Should Do
- Back up your site, then update. Go to the Dashboard, open Updates, and select Update Now, or download 7.1.4 from WordPress.org. Afterwards, confirm the site actually finished on 7.1.4.
- Look for signs of compromise. Check for suspicious requests to PHP files under wp-content/upgrade, and for unfamiliar administrator accounts, plugins or PHP files.
- Check with your host if you don’t manage updates yourself. Some managed hosts push security releases from their own dashboards.
- Keep WordPress updated. 7.1.4 is the seventh core security release since July. The next major release, 7.2, is currently planned for December 8.
Don’t Confuse It With Php2shell
A separate set of critical PHP flaws, known as PHP2Shell, is also circulating. A WordPress update does not fix those. They require updating PHP on the server. Patching WordPress is necessary, but it doesn’t cover the PHP issue.
Bottom line: the exploit window is short, but attackers are automating attempts at scale. If your site is on anything older than 7.1.4, update now.
Leave a Reply