Wordfence says it blocked 62,969 attack attempts in 24 hours targeting a remote-code-execution flaw in WordPress Core, a figure also reported by The Hacker News. The vulnerability was patched in the WordPress 7.1.4 security release on October 28. The figure represents blocked requests, not 62,969 compromised websites or confirmed successful intrusions.
The flaw affects WordPress Core versions 4.7.0 through 7.1.3 and was reported by security researcher Umut Bayram. The official WordPress 7.1.4 release describes a weakness in the core upgrade process that could lead to remote code execution during the update window. The project’s GitHub security advisory identifies it as a race condition and lists no CVE identifier.
During a full-package update, WordPress extracts new files into a temporary directory inside the web-served wp-content/upgrade folder. The staged copy includes the installer. An unauthenticated attacker who can reach that directory and wins the race against the extraction process could interact with the installer and reach code execution before WordPress removes the temporary files. The vulnerable window exists only while the update is running.
Wordfence said its first matching request arrived nine minutes after the company deployed a firewall rule on October 28. Attackers have repeatedly checked staged installer paths such as setup-config.php, with some sources polling the same targets for hours in an attempt to catch an update in progress. Wordfence’s 62,969 blocked requests do not establish how many sites were targeted or whether any were successfully compromised.
WordPress 7.1.4 fixes the issue in the latest release, while maintenance updates are available for older supported branches, with patches reaching version 4.7.39. Site owners should confirm that they are running the fixed release for their branch and review server logs for unexpected requests to PHP files beneath wp-content/upgrade. The wider WordPress 7.1.4 security update also addresses other security issues.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
