Attackers race to exploit newly patched WordPress Core code execution flaw

Attackers are already attempting to exploit a newly disclosed high-severity vulnerability in WordPress Core, according to SecurityWeek, which cited analysis from security firm Wordfence. The flaw sits in WordPress Core's update process rather than in any single plugin or theme, and can be abused for unauthenticated remote code execution.

What happened

SecurityWeek, in an October 30, 2026 report by Ionut Arghire, describes the issue as a race condition in how WordPress unpacks update packages. According to the report, new files are extracted into a staging directory that many servers expose to the web, and the paths are predictable. An attacker who can reach those paths during the brief unpacking window, using a full-package update that contains installer files, could execute code without any account on the site. SecurityWeek notes that the attack complexity is high: the attacker must hit a narrow time window before WordPress deletes the temporary files. No CVE identifier has been assigned yet.

Active exploitation

Wordfence says threat actors are already trying to exploit the flaw by repeatedly polling vulnerable paths, according to SecurityWeek. The first hit on Wordfence's new firewall rule came just nine minutes after it was deployed, and in the first 21 hours the firm recorded more than 18,500 requests targeting staged setup-config.php installer paths. Wordfence has not reported any successful compromises so far.

Who is affected

The vulnerability is in WordPress Core, which powers a large share of the web, so any site that performs core updates is potentially in scope. SecurityWeek reports that the fix was backported to branches as far back as WordPress 4.7, indicating the weakness has been present across many older releases. The report does not list the exact vulnerable version range.

What to do

According to SecurityWeek, the issue was patched on October 28, 2026 in WordPress 7.1.4, which now randomizes the staging directory, adds an index guard, and blocks unsafe promotion of staged configuration data. The same release fixes 22 security defects in total, including several cross-site scripting flaws, Interactivity API issues, an unauthenticated information-disclosure bug, and an authorization weakness, and it updates bundled root certificates following the eMudhra revocation. Administrators should update to 7.1.4 (or the backported fix for their branch) immediately. Because the attack depends on publicly reachable staging paths during updates, operators should also verify that update staging directories are not exposed to the web.