Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Vulnerabilities

Fresh WordPress Vulnerability in Attackers’ Crosshairs

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

By

Ionut Arghire

| October 30, 2026 (8:04 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Threat actors started exploiting a new high-severity WordPress vulnerability within hours of patches rolling out, Defiant warns.

Patched on October 28 in WordPress 7.1.4, the security defect impacts the WordPress update process and can be exploited for remote code execution.

According to Defiant, it is a race condition in WordPress’s Core update process that can be exploited without authentication. The attack complexity, however, is high. No CVE identifier has been assigned to the vulnerability yet.

The weakness stems from predictable, web-accessible staging paths during the upgrades. New files are unpacked into a predictable directory that is accessible from the web on many servers.

“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,” Defiant explains.

According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.

Advertisement. Scroll to continue reading.

While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.

To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.

“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.

Wordfence has not reported successful compromises.

Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.

WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recent eMudhra revocation.

Related:Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

Related:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
  • Over 41,000 DHS Employee Records Leaked Online
  • HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
  • Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
  • Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
  • Chrome and Firefox Updates Patch Over 200 Vulnerabilities
  • China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  • Hackers Start Probing Fresh Oracle EBS Vulnerability

Latest News

  • Drupal Commerce Core Vulnerability Exploited Against Online Stores
  • $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
  • Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
  • TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
  • $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
  • When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
  • Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
  • How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI

Trending

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

Hackers Start Probing Fresh Oracle EBS Vulnerability

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: Agentic Pentesting for a Stronger CTEM Program

November 4, 2026

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Quantum eMotion has named Wayne Teeple as CTO.

Guy Ellis has been appointed CEO of NCC Group.

Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)