Attackers began targeting a serious WordPress flaw within a day of the fix. Security firm Wordfence blocked 62,969 attempts, so site owners should update.
Attackers are already going after a serious flaw in WordPress, the software behind a huge number of business websites. Fixes came out on October 28, 2026. Within about a day, security company Wordfence said it had blocked 62,969 attacks aimed at the problem.
The flaw lets an attacker run their own code on the server that hosts a website. Security people call this remote code execution. It is rated 8.1 on a 10-point severity scale, and it has no CVE number, which is the usual public ID tag for security bugs.
It comes down to how WordPress updates itself. During a full update of its core software, WordPress unpacks the new files into a predictable folder under wp-content/upgrade. That copy includes the WordPress installer. On many servers, that folder can be reached from the web.
Wordfence says an outsider who requests the installer at exactly the right moment can interact with that temporary copy and work toward running code. No login is needed.
The window is tiny. Wordfence says it lasts only seconds in normal lab tests, and an attacker has to hit it while WordPress is unpacking an update. So attackers are simply trying over and over. They repeatedly request a file called setup-config.php, hoping to land at the right instant.
Wordfence's Alex Thomas said two of the largest sources kept polling small groups of sites for roughly 14.5 hours. Other sources tried many variations of folder and version names. Not every request used the exact vulnerable path, but he said the steady probing shows attackers quickly understood how the flaw works.
Any WordPress site on versions 4.7 through 7.1.3 is in the affected range. That covers small business sites, blogs and online stores. The fixed version is 7.1.4. Sites already running 7.1.4 have the fix.
A successful attack needs the narrow timing described above, so not every site is equally exposed at every moment. That is not a reason to wait. Attackers are actively trying, and a site that gets taken over can be used to steal data or cause damage.
The alert box above lists the steps. The short version: update to 7.1.4, have your host or developer confirm it worked, and check for anything you do not recognize, such as new administrator accounts, plugins or files.
The source material mentions a list of conditions that must be met for an attack to work, but the details are not included. It also does not say how many sites have actually been compromised. The 62,969 figure counts blocked attempts seen by Wordfence, not successful break-ins.
If your site runs WordPress, update it to version 7.1.4 now, because attackers began trying to exploit this flaw soon after the fix came out.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
