Threat actors have been observed attempting to exploit a high-severity security flaw in **WordPress Core** shortly after patches were released. This vulnerability, which currently lacks a **CVE** identifier, presents a significant risk for remote code execution. ### The Vulnerability Explained The flaw, impacting **WordPress Core** versions 4.7 through 7.1.3, carries a **CVSS** score of 8.1. Patches for the issue were released on October 28, 2026, with **WordPress 7.1.4**. According to **Wordfence**, the vulnerability stems from "predictable, web-accessible staging paths used during full-package core upgrades." This creates a critical window where unauthenticated attackers can execute code on the server during the upgrade process. Successful exploitation requires a precisely timed attack, hitting a "very narrow window while WordPress is unpacking a complete Core update." ### Race Condition Mechanics The core of the problem lies in how affected **WordPress** versions unpack new files during a full-package Core update. These files are temporarily placed into a predictable directory under `wp-content/upgrade`, which also includes the **WordPress** installer. **Alex Thomas**, who leads the **Wordfence Threat Response Team**, explained: "Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged **WordPress** copy and progress to **PHP** code execution." For an attacker to win this race condition and achieve code execution, several conditions must be met: * A full-package update containing the installer files. * Public web and **PHP** access to the staging tree. * A predictable or discovered staging path. * Adequate time to complete the attack before **WordPress** cleans up the temporary files. ### Active Exploitation Detected While the vulnerable window typically lasts only seconds in lab environments, threat actors are actively polling vulnerable paths, such as `setup-config.php`, in an attempt to trigger the flaw. **Wordfence** reported blocking 62,969 attacks targeting this vulnerability within a 24-hour period. "Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window," Thomas noted. "Other sources tested many staging-directory and version-name variations." The sustained polling and precise probes indicate that attackers quickly understood and began targeting this race condition. ### Urgent Call to Action With active exploitation attempts already underway, **WordPress** site owners are strongly advised to update to version 7.1.4 as soon as possible. Additionally, administrators should monitor their systems for suspicious requests to **PHP** files located under `wp-content/upgrade`, as well as for unfamiliar administrator accounts, plugins, or **PHP** files.