WordPress published a security advisory about a flaw in how its core updates work. During a full-package update, WordPress unpacked new files into a predictable folder inside the web-served upgrade directory. The advisory says an attacker with no login who beats the unpacking in a race could run code on the server. Umut Bayram found and reported the bug. WordPress fixed it in 7.1.4 and also in older branches back to 4.7. The Hacker News reported that the patches came out on October 28, 2026.
The Hacker News, citing security firm Wordfence, reported a CVSS score of 8.1 and no CVE identifier, which is the standard public ID for a flaw. Wordfence said it blocked 62,969 attacks aimed at the bug over the past 24 hours. It said two of the largest sources polled small groups of sites for about 14.5 hours. Wordfence said the window lasts only seconds in lab tests. The attack also needs a full-package update, public web access to the staging folder, a findable path and enough time before cleanup. The sources do not say whether any site was actually compromised.
Sites on affected versions, from 4.7 through 7.1.3, face a bug that attackers are already testing in large numbers. Wordfence advises updating to 7.1.4 and checking for suspicious requests to PHP files under wp-content/upgrade. It also advises looking for unfamiliar admin accounts, plugins or PHP files. Teams that run or host WordPress for others can use those checks to see whether they were probed.