Cybersecurity

Fresh WordPress Vulnerability Targeted by Attackers

Threat actors have quickly targeted a newly patched, high-severity WordPress vulnerability involving an unauthenticated race condition that can lead to remote code execution.

Radwan AbdulhadiEditor and technology writer

Published: October 31, 2026 · Updated: October 31, 2026 · 3 min read

Fresh WordPress Vulnerability Targeted by Attackers — Image: SecurityWeek

Overview of the WordPress Vulnerability

Threat actors have begun targeting a high-severity security flaw affecting the WordPress content management system shortly after patches were rolled out. Patched on October 28 in [WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/), the defect impacts the core update process and can potentially be exploited to achieve remote code execution.

According to Defiant, the issue is an unauthenticated race condition within the WordPress Core update mechanism. Despite its severity, the attack complexity is considered high, and no CVE identifier has been assigned to the vulnerability at this time.

Exploitation Mechanics and Predictable Staging Paths

The underlying weakness stems from predictable, web-accessible staging paths utilized during upgrades. New files are unpacked into a predictable directory that remains accessible from the web on many affected servers.

As [Defiant explains](https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/), executing an attack requires a full-package update containing installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and sufficient time to complete the actions before temporary files are cleaned up by WordPress.

While unauthorized individuals do not need a user account on a site to exploit the flaw, they must time their requests precisely during the seconds-long window when WordPress unpacks a complete core update.

Active Exploitation and Telemetry Insights

Web security telemetry from Wordfence demonstrates that malicious actors wasted no time in attempting to leverage the bug. Automated probes began polling vulnerable paths repeatedly in an effort to catch the narrow window of opportunity.

Data shows that the first match for a newly deployed firewall rule arrived a mere nine minutes after implementation. Over the initial 21 hours of observation, Wordfence recorded more than 18,500 distinct requests targeting staged setup-config.php installer paths. Despite the aggressive polling activity, no successful compromises have been reported so far.

Remediation and Additional Patches in 7.1.4

To mitigate the security bug, the WordPress update introduces several core alterations. The platform now randomizes the staging directory, incorporates an index guard, and halts the unsafe promotion of staged configuration data.

Official fixes are included in the [WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/) release and have also been backported to older branches extending back through WordPress 4.7. Alongside this crucial security update, the package ships with resolutions for 22 other defects, including cross-site scripting vulnerabilities, interactivity API bugs, an unauthenticated information disclosure issue, an authorization weakness, and an update to bundled root certificates reflecting the recent [eMudhra revocation](https://www.securityweek.com/browsers-block-emudhra-intermediate-cas-over-recoverable-private-keys/).