Affected Systems

WordPress Core versions 4.7 through 7.1.3. Vulnerability exploits predictable staging paths during full-package core upgrades. Fixed in version 7.1.4 released October 28, 2026.

Exploitation Status

Active exploitation confirmed. Wordfence blocked 62,969 attack attempts in the first 24 hours post-patch. Attackers are polling vulnerable paths like setup-config.php repeatedly to exploit the race condition during upgrade windows.

Business Impact

High-severity RCE (CVSS 8.1) allows unauthenticated attackers to execute arbitrary code on WordPress servers during core updates. Exploitation requires winning a race condition during the brief upgrade window (typically seconds), but sustained polling campaigns demonstrate attacker understanding of the technique. Successful compromise grants full server-level code execution. No CVE assigned, which may complicate vulnerability tracking in enterprise asset management systems.

Urgency

🔴 Immediate

Recommended Actions

  • Update all WordPress installations to version 7.1.4 immediately
  • Search web server logs for suspicious requests to PHP files under wp-content/upgrade/ directory, particularly setup-config.php
  • Audit WordPress sites for unfamiliar administrator accounts created since October 28, 2026
  • Review installed plugins and themes for unauthorized additions or modifications
  • Consider blocking public web access to wp-content/upgrade/ directory at the web server or WAF level if operationally feasible