Emerging ThreatsMalware & Ransomware

WordPress Sites Targeted in Widespread Exploitation of RCE Flaw

Analyst 207||Source: TheHackerNews
Rows of rack-mounted servers and networking equipment in a brightly-lit server room with technicians working in the…

62,969 attack attempts were blocked in a single 24‑hour period after patches were issued for a high‑severity WordPress Core flaw, Wordfence reported.

The flaw: predictable, web‑accessible staging paths during Core upgrades

Wordfence detailed a remote code execution vulnerability affecting WordPress Core versions 4.7 through 7.1.3, with a CVSS score of 8.1. Patches addressing the issue were released on October 28, 2026. The company summarized the root cause plainly: "This is due to predictable, web-accessible staging paths used during full-package core upgrades," which can permit unauthenticated attackers to execute code on the server during the upgrade window.

Exploit mechanics and prerequisites for success

At the heart of the bug is a staging behavior: when a full‑package Core update is unpacked, new files — including the WordPress installer — are copied into a predictable directory under "wp-content/upgrade." Because that staging directory is web‑accessible on many servers, an attacker who requests the installer at precisely the right moment can interact with the staged copy and progress to PHP code execution, Alex Thomas, who leads the Wordfence Threat Response Team, said.

  • A full‑package update containing the installer files
  • Public web and PHP access to the staging tree
  • A predictable or discovered staging path
  • Adequate time to complete the attack before WordPress cleans up the temporary files

Wordfence noted that the exploitable window has been observed to last only seconds in normal laboratory environments, creating a race condition attackers must win to succeed.

Observed exploitation attempts: scale, persistence, and tactics

Wordfence said it blocked 62,969 attacks targeting the vulnerability in the 24 hours after the patches were released. The company reported that two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours — behavior Wordfence described as consistent with attempts to catch the brief upgrade window. Other sources probed many staging‑directory and version‑name variations, and attackers repeatedly polled vulnerable paths such as "setup-config.php" in an effort to trigger the flaw. "Not every request used the exact vulnerable path, but the sustained polling and exact-layout probes show that attackers quickly understood the race condition and began targeting it," Wordfence said.

Wordfence guidance: update to 7.1.4 and hunt for telltale signs

With active exploitation attempts underway, Wordfence advised WordPress site owners to update to version 7.1.4 as soon as possible. The company also recommended inspecting logs and site contents for indicators tied to the vulnerability, specifically suspicious requests to PHP files located under "wp-content/upgrade," and checking for unfamiliar administrator accounts, plugins, or PHP files that could indicate a successful compromise.

How technologists, site owners, and adversaries are responding

Technologists and security teams — particularly those responsible for WordPress deployments — will prioritize applying the October 28, 2026 patches to move affected instances off versions 4.7 through 7.1.3 and onto 7.1.4. They will also search server logs for repeated polling of staging paths like "setup-config.php" and unexpected PHP activity in "wp-content/upgrade."

WordPress site owners and operations teams will be advised to harden public web and PHP access to upgrade staging trees where feasible, and to monitor for unfamiliar administrator accounts, plugins, or stray PHP files that Wordfence identified as post‑exploit indicators.

Adversaries — already observed by Wordfence — are conducting high‑volume, persistent probes and experimenting with variations in staging directory names and version strings. The company's observations that two sources polled small groups for about 14.5 hours and that many sources used sustained polling underscore a continued focus by attackers on beating the narrow upgrade‑time window.

Wordfence's findings make clear that the window for exploitation is small but exploitable at scale: attackers can compensate for a brief race condition by persistent, automated probing. For now, the concrete next steps are straightforward and specific — apply the October 28 patches (move to 7.1.4), and hunt for the precise indicators Wordfence lists — but the incident also leaves a practical question for site operators: how to eliminate web accessibility of upgrade staging paths in diverse hosting environments where those paths are currently reachable.

Source: The Hacker News — WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Emerging ThreatsPatch ManagementRemote Code ExecutionSupply ChainWordpressWeb Application SecurityCVE-2026-1234 Is Not Present However Based On Context A Likely Tag Could BeRansomware Is Not Indicated But Possible Future Threat Vector Nation State Not Indicated But PossibleZero Day Is Not Indicated As It Was PatchedSo MFA Not Indicated But Possible Future Threat Vector Therefore Vulnerability Management
Related Intelligence

Continue Reading

Developer workstation with laptop and monitor showing blurred coding interfaces in a quiet, empty space.

Anthropic Disputes Link to Malicious Claude Code Extension Compromise

Anthropic is investigating a malicious Claude Code extension with Cursor, confirming it wasn't a breach of their own systems or employee laptops. A bad actor hijacked Cursor's marketplace to publish a tampered extension, Anthropic says, which they didn't build or publish.

Analyst 207
Disassembled Trezor hardware wallet with suspicious circuit board exposed.

Trezor Exposes Suspected Crypto-Theft Implant in Hardware Wallet Supply Chain

A Trezor Safe 5 hardware wallet purchased from a reseller in Southeast Asia was found to contain a suspicious extra circuit board with a cellular module and antenna, sparking concerns of a potential crypto-theft implant. This shocking discovery raises questions about the security of the supply chain and the safety of cryptocurrency storage.

Analyst 207
VS Code extension marketplace interface with blurred center panel on a developer's laptop screen.

Malicious Claude Code Extension Targets 5,000 Developers with SSH Backdoor

A malicious version of the popular Claude Code extension was compromised, putting 5,000 developers at risk of a persistent SSH backdoor malware that was served from a trusted VS Code marketplace for nearly 11 hours. The sneaky malware was cleverly hidden in a JavaScript loader, allowing it to execute immediately without requiring any user interaction.

Analyst 207
Dimly lit telephone booth with door ajar and phone off the hook.

Signaling Flaws Expose Millions to Phone Tracking, Hacking

Millions of people are vulnerable to phone tracking and hacking due to flaws in the signaling systems that route calls and texts, allowing attackers to intercept, impersonate, or silence phones without ever touching them. These attacks, uncovered by Citizen Lab, have targeted thousands of people in dozens of countries.

Analyst 207