Fresh WordPress Vulnerability in Attackers’ Crosshairs

What it is

A race condition in the WordPress core update process, fixed in WordPress 7.1.4 on 28 October 2026. It allows unauthenticated remote code execution. No CVE is assigned yet. Defiant, the maker of Wordfence, reports that attackers began probing for it within hours of the patch.

How it works

During a core upgrade, WordPress unpacks new files into a predictable staging directory. On many servers that directory is reachable from the web. An attacker who polls the staging paths can reach the files during the seconds-long window before WordPress cleans them up. Wordfence's observed probes target staged setup-config.php installer paths.

Preconditions / Affected

Defiant lists four conditions that must all hold:

• A full-package update that contains the installer files.
• Public web and PHP access to the staging tree.
• A predictable or discovered staging path.
• Enough time to finish the attack before WordPress deletes the temporary files.

The attack needs no account, but it must land inside the narrow unpacking window of a complete core update. Defiant rates the attack complexity as high. The fix is backported to branches through WordPress 4.7.

flowchart TD
    A[Full core update starts] --> B[Files unpack to staging dir]
    B --> C{Web and PHP access to staging?}
    C -- No --> X[Not exploitable]
    C -- Yes --> D{Attacker hits path before cleanup?}
    D -- No --> X
    D -- Yes --> E[Remote code execution]

What to do

• Update to WordPress 7.1.4, or to the backported release on your older branch (back to 4.7).
• The patch randomizes the staging directory, adds an index guard, and blocks unsafe promotion of staged configuration data.
• The same release fixes 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness. It also updates the bundled root certificates for the recent eMudhra revocation. Updating therefore covers more than this one flaw.
• To check for probing, look in web logs for repeated requests to staged setup-config.php paths. Wordfence saw more than 18,500 such requests in the first 21 hours. Its new firewall rule matched its first request nine minutes after deployment.

Caveats

Wordfence has reported no successful compromises. The page gives no exact staging path, no patched version numbers for the backported branches, and no CVE. Exploitation is only attempted so far, and the high complexity limits how reliably it works.