60,000+ WordPress Attack Attempts in 24 Hours: Critical RCE Vulnerability Puts Websites on Alert

A newly patched WordPress security vulnerability is already attracting significant attention from cybercriminals. Within approximately 24 hours, security provider Wordfence recorded more than 60,000 blocked attack attempts targeting a remote code execution (RCE) flaw in WordPress Core.

The activity highlights how quickly attackers can begin probing websites after a security patch becomes public. Even vulnerabilities that require precise timing can become attractive targets when they affect widely deployed platforms.

For businesses that depend on WordPress for websites, customer portals, online services, and e-commerce operations, this incident is a reminder that timely patching and continuous security monitoring are essential.

What Happened?

WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities, including a high-severity remote code execution issue.

The vulnerability, identified as CVE-2026–119977, affects WordPress Core versions 4.7 through 7.1.3. It was assigned a CVSS 3.1 score of 8.1 by Wordfence.

The issue is associated with a race condition in the WordPress core update process. It can potentially allow an unauthenticated attacker to execute code on a vulnerable server under specific conditions.

According to the reported Wordfence telemetry, 60,471 blocked attempts were recorded over a 24-hour period. These figures represent malicious requests, not confirmed successful compromises or the number of individual websites breached.

How Does the WordPress RCE Vulnerability Work?

The vulnerability is connected to the temporary staging directory WordPress uses when performing a complete core update.

During the update process, WordPress extracts files into a temporary location under:

wp-content/upgrade/

For a brief period, certain installation-related files may become accessible through the web server. The race condition can allow an unauthenticated attacker to attempt to access a staged installer, such as setup-config.php, while the update is in progress.

If the attacker reaches the vulnerable installation process at the right moment and the required conditions are present, it may be possible to connect the installer to an attacker-controlled database and execute PHP code on the server.

The opportunity is narrow. The temporary directory may remain exposed for only seconds during an update. However, automated and repeated requests can increase the chances of encountering that window.

This is why the vulnerability is particularly concerning despite its timing requirements.

Why Are Attackers Moving So Quickly?

The attack activity demonstrates a familiar pattern in vulnerability exploitation:

1. A security update becomes publicly available.
2. Attackers analyze the changes to understand what was fixed.
3. Automated tools identify websites running potentially vulnerable versions.
4. Repeated requests probe the affected paths and installation files.
5. Attackers attempt to exploit systems that have not yet been patched.

Wordfence reported sustained probing activity, including sources that repeatedly checked small groups of websites over extended periods in an effort to catch the brief update window.

The speed of this activity reinforces the importance of treating security patch announcements as operational priorities rather than routine maintenance tasks.

Which WordPress Versions Are Affected?

The vulnerability affects multiple WordPress release branches.

The corresponding security-fixed versions include:

Affected branchFixed version7.17.1.47.07.0.86.96.9.116.86.8.126.76.7.116.66.6.116.56.5.146.46.4.146.0 to 6.3Corresponding branch-specific security releases

Administrators should verify the exact version installed on every website and apply the corresponding security release. WordPress versions 4.6 and earlier no longer receive security updates.

How WordPress Addressed the Vulnerability

The 7.1.4 release introduces changes to make the update staging process more secure.

The fixes include:

• Randomizing temporary staging directory names to make them harder to predict.
• Strengthening protection around the index.php file in the upgrade directory.
• Preventing unsafe copying of sensitive configuration data, including wp-config.php, from the temporary working directory.

These changes reduce the opportunity for attackers to access the staged installation process during core updates.

WordPress also released corresponding security fixes for older supported branches.

What Should Website Administrators Do?

Organizations operating WordPress websites should prioritize the following actions.

1. Update WordPress Core Immediately

Install version 7.1.4 or the appropriate fixed release for the installed branch. Do not assume automatic updates have completed successfully. Verify the installed version through the WordPress dashboard or centralized website management tools.

2. Restrict Access to the Upgrade Directory

Where server-level control is available, deny public HTTP access to:

wp-content/upgrade/

The directory should not be publicly accessible or directory-listable. Apply restrictions through the web server or virtual host configuration, rather than relying only on a WordPress plugin.

3. Review Web Server and Security Logs

Look for unusual requests targeting:

• setup-config.php
• Files and paths under wp-content/upgrade/
• Unexpected PHP requests during update activity
• Repeated requests from unfamiliar IP addresses

Investigate suspicious activity rather than assuming every blocked request indicates a successful attack.

4. Inspect Website Files and Administrator Accounts

Check for unfamiliar PHP files, unexpected changes to core files, suspicious plugins, and unauthorized administrator accounts. Review file modification timestamps and compare critical files against trusted WordPress releases.

5. Strengthen Web Application Firewall Protection

Use a properly configured web application firewall to detect and block suspicious requests. However, firewall protection should be treated as an additional security layer, not a replacement for installing the official security update.

6. Maintain Regular Backups

Keep tested, protected backups of website files and databases. Ensure recovery procedures are documented so that the organization can restore services if a compromise occurs.

7. Review Third-Party Plugins and Themes

Although this particular vulnerability affects WordPress Core, outdated plugins and themes can introduce additional weaknesses. Maintain an inventory of installed components and remove those that are no longer required.

Conclusion

The discovery of more than 60,000 blocked attack attempts against a newly patched WordPress vulnerability demonstrates how quickly attackers respond to publicly disclosed security issues.

Although the reported activity does not confirm 60,000 successful compromises, it shows that vulnerable websites can become targets almost immediately after a security advisory is released.

Organizations should not wait for evidence of a breach before taking action. Prompt patching, server-level access restrictions, continuous monitoring, secure backups, and regular vulnerability assessments are essential to protecting WordPress environments.

For businesses that rely on WordPress for customer engagement and daily operations, website security must remain an ongoing priority.

About COE Security

COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.

Our offerings include:

• AI-enhanced threat detection and real-time monitoring
• Data governance aligned with GDPR, HIPAA, and PCI DSS
• Secure model validation to guard against adversarial attacks
• Customized training to embed AI security best practices
• Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
• Secure Software Development Consulting (SSDLC)
• Customized CyberSecurity Services

COE Security helps organizations identify application vulnerabilities, assess web application security, evaluate infrastructure risks, and strengthen their security posture through penetration testing and security consulting.

We support businesses in building more resilient digital environments while addressing cybersecurity risks and compliance requirements.

Follow COE Security on LinkedIn for the latest cybersecurity news, vulnerability alerts, and practical guidance to help your organization stay secure and cyber safe.