Seems like WordPress has found itself in a bit of a pickle. In just 24 hours, nearly 63,000 attempts were made to exploit a security hole that's about as inviting as an open bathroom door. The vulnerability, which involves something fancy called remote code execution (RCE), was discovered shortly after the patches were rolled out. But hey, who wouldn't want a little extra chaos during a WordPress upgrade?
The flaw affects WordPress Core versions 4.7 to 7.1.3 and boasts a not-so-humble CVSS score of 8.1. Yes, that’s as bad as it sounds! WordPress hastily patched the issue on October 28, 2026, but it seems the cyber villains were just waiting for their moment to pounce.
According to the security wizards over at Wordfence, this delightful mess is all thanks to staging paths that are as predictable as a running gag in a sitcom. These paths, intended for core upgrades, are open to the world, allowing anyone with nimble fingers to execute code during the “upgrade window.” Thank you, WordPress, for providing a roadmap straight to mayhem.
To exploit this, attackers need to hit a very narrow window, like trying to catch a bus that only shows up once every ten years. They have to time it just right while WordPress is unpacking a core update and cleaning up after itself. In a lab setting, this window is only a few seconds, but the attackers aren’t taking any chances. They’ve been repeatedly bombarding vulnerable paths like "setup-config.php" in a frantic game of digital whack-a-mole.
In fact, Wordfence reported blocking a staggering 62,969 attacks just in the last day. Seems like two main sources have been leading the charge, polling small groups of unsuspecting sites for over 14.5 hours straight. It's almost like a cyber scavenger hunt, but with better odds of finding a jackpot and worse odds of making friends.
With the attack already in full swing, WordPress users are urged to update to version 7.1.4 faster than you can say “cybersecurity risk.” And while you're at it, keep an eye out for strange PHP requests and unfamiliar admin accounts, because that’s the digital equivalent of checking for monsters under the bed.
So, if you’ve got a WordPress site, it might be time to send a little love to your update button before the hackers win the race.
