WordPress · Exploitation confirmed

Nearly 63,000 attacks hit WordPress RCE flaw in 24 hours

Oct 28, 2026 · 1 min read

A WordPress core flaw allows unauthenticated remote code execution during the brief core update window. Nearly 63,000 attack attempts were recorded in 24 hours. Update WordPress to version 7.1.4.

By HIFY Radar newsroom Updated 11/03/2026 05:36 PM Get this every day →← Back to the feed 5 sources

HighVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A flaw in the WordPress Core update process allows unauthenticated remote code execution during the update window. Attackers began probing hours after the patch shipped on October 28, and nearly 63,000 attempts were recorded in 24 hours. CISA added the flaw to its KEV catalog as CVE-2026-119977, with a federal deadline of November 6, 2026.

Why it matters

Any WordPress site on versions 4.7 through 7.1.3 is exposed to code execution every time the core updates. Wordfence has reported no successful compromises, but the attempt volume and the KEV listing raise the risk and create regulatory urgency for US federal agencies.

What to do

Update immediately to WordPress 7.1.4, or the security releases for branches 4.7 through 7.0, via Dashboard > Updates. Investigate suspicious PHP requests under wp-content/upgrade and confirm automatic background updates are enabled.

For the technical team

CVE: CVE-2026-119977
Affected: WordPress (núcleo), versão 7.1.4 · WordPress Core 4.7 through 7.1.3. Versions 4.6 and earlier no longer receive security updates.
Exploitation: Active attempts reported by Defiant/Wordfence: probing began hours after 7.1.4 shipped on October 28; more than 18,500 requests to staged setup-config.php installer paths in the first 21 hours, with the first detection 9 minutes after the firewall rule deployed. The Hacker News reports nearly 63,000 attempts in 24 hours. CISA listed it in KEV as CVE-2026-119977, deadline November 6, 2026. Wordfence has reported no successful compromises.
Fix: WordPress 7.1.4, with fixes also backported to branches 4.7 through 7.0. The fix randomizes the staging directory, adds an index guard, and prevents unsafe promotion of staged configuration data.
Vector: WordPress Core, TOCTOU race condition in the update process: new files are unpacked into a predictable, web-accessible staging directory on many servers. Unauthenticated exploitation with high attack complexity: requires a full-package update containing installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time before WordPress cleans up temporary files.
More details: Version 7.1.4, released October 28, fixes 22 flaws, including stored XSS in block markup, privacy data removal requests, the Interactivity API, Customizer selective refresh, categories, playlists, images, comment pagination and crafted usernames; disclosure of unpublished Customizer changes to unauthenticated visitors; a stored denial-of-service issue in the Interactivity API; improper access to Notes; and replacement of bundled root certificates after the eMudhra revocation. The RCE flaw had no CVE at disclosure; third parties give conflicting CVSS scores of 8.1 and 9.0, while official severity is low. Discovered and reported by Defiant (Wordfence).

Timeline

11/03/2026 05:36 PM
CISA adds the flaw to the KEV catalog as CVE-2026-119977, with a federal deadline of November 6, 2026 to apply fixes.
10/30/2026 01:44 PM
Monitoring logs nearly 63,000 exploitation attempts in 24 hours; the RCE flaw affects WordPress Core versions 4.7 through 7.1.3 (CVSS 8.1), with no CVE identifier assigned.
10/30/2026 11:56 AM
New detail: attacker probing began hours after version 7.1.4 shipped on October 28; the flaw still has no assigned CVE and is officially rated low severity.

Want the next updates in your inbox? Get the daily edition →

See all 6 updates

10/30/2026 11:10 AM
The Hacker News reports nearly 63,000 attack attempts against the flaw in just 24 hours.
10/30/2026 09:11 AM
SecurityWeek reports attackers are already attempting to exploit the unauthenticated race condition leading to remote code execution in WordPress.
10/28/2026 05:18 PM
WordPress ships version 7.1.4 with fixes for 22 vulnerabilities.