Threat reportVulnerabilityTL-2026-4804
Active Exploitation of WordPress Core Unauthenticated Upgrade-Window RCE (Versions 4.7 through 7.1.3) Hours After 7.1.4 Patch Release
Active Exploitation of WordPress Core Unauthenticated (TL-2026-4804) is a high-severity software vulnerability scored CVSS 8.1, first published 2026-10-30. It has no confirmed attribution, affects WordPress WordPress Core, maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1587.004), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 8.1/10High
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-4804
- Threat ID
- TL-2026-4804
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, retail, education, government administration, non-profit organisation
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Active Exploitation of WordPress Core Unauthenticated
Malware and tooling: PHP
How Active Exploitation of WordPress Core Unauthenticated works
A race-condition flaw in the WordPress core update process exposes a predictable, browsable staging folder under wp-content/upgrade that holds a full WordPress install, letting unauthenticated attackers reach wp-admin/setup-config.php during the seconds-long update window. Wordfence recorded more than 18,500 requests aimed at staged installer paths in the first 21 hours after the 7.1.4 release (2026-10-28); how many sites were compromised is not established.
WordPress 7.1.4, released on 2026-10-28, fixes an unauthenticated remote code execution weakness in the core update process reported by researcher Umut Bayram. It affects WordPress Core 4.7 through 7.1.3; the fixes were backported to every branch eligible for security fixes (patched releases reach back to 4.7.39). No CVE identifier has been published in the sources reviewed.
During a Core update that uses a complete WordPress package, affected versions unpack the new files into a predictable directory beneath wp-content/upgrade. Patchstack's analysis describes this as a guessable and browsable path holding a complete WordPress install. That copy includes wp-admin/setup-config.php, which boots on its own without the site's configuration. Cleanup that removed index.php could also leave the folder listable. An attacker who reaches the staged installer during the update could run setup against a database they control, inside the victim's document root, creating a path to code execution. Exploitation needs no WordPress account but requires the web server to allow public access and PHP execution under wp-content/upgrade, and the attacker must request the right path while an update is running. Lab testing showed the staging folder remains reachable for only seconds, so exploitation is a race that depends on repeated automated polling. Patchstack scored the issue AC:H and does not call it practical to exploit.
Wordfence deployed a firewall rule at 20:30 UTC on 2026-10-28, about three hours after the release. The first matching request arrived nine minutes later. Over the first 21 hours Wordfence recorded more than 18,500 requests targeting staged setup-config.php installer paths, and two major sources repeatedly polled for roughly 14.5 hours. The reporting does not say how many sites were breached, and it names no threat actor, malware, or network infrastructure.
The 7.1.4 fix appends 16 random characters to the temporary folder name, restores index.php protection (it is no longer deleted between updates), and stops wp-config.php from being copied from the working directory. WordPress 7.1.4 also contains other security fixes (stored XSS in several components, an Interactivity API denial of service, and unauthenticated discovery of unpublished Customizer changesets); the release announcement lists 13 items, while press coverage counts 22 flaws across 17 advisories.
MITRE ATT&CK techniques used in TL-2026-4804
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Reconnaissance
Affected products and versions in Active Exploitation of WordPress Core Unauthenticated
- WordPress — WordPress Core
Vulnerable versions: 4.7 through 7.1.3
Fixed in: 7.1.4; backported releases for branches back to 4.7 (4.7.39 through 7.1.4)
Remediation for Active Exploitation of WordPress Core Unauthenticated
Patches
- WordPress 7.1.4 (released 2026-10-28)
- Backported security releases for branches back to 4.7 (4.7.39 through 7.1.4)
Immediate actions
- Update WordPress to 7.1.4 or the corresponding patched release for your branch (4.7.39 through 7.1.4) and confirm status under Dashboard > Updates
- Deny web access to wp-content/upgrade/ at the web server and confirm the directory is not listable
- Block direct PHP execution under wp-content/upgrade/
- Review web access logs for requests to wp-content/upgrade/ paths and setup-config.php, especially around update times
Workarounds
- Deny access to wp-content/upgrade/ at the web server until patched
- Schedule core updates for low-traffic windows and monitor the upgrade directory while they run
Longer-term hardening
- Disable PHP execution in wp-content subdirectories that do not need it
- Review accounts with Contributor privileges or higher (Patchstack recommendation)
- Enable WAF virtual patching, such as Wordfence Extended Protection, and verify firewall optimization
Weaknesses (CWE) in Active Exploitation of WordPress Core Unauthenticated
Timeline of Active Exploitation of WordPress Core Unauthenticated
- The first request matching the Wordfence rule arrives nine minutes after the rule is deployed.
- Wordfence deploys a firewall rule for the upgrade-window RCE at 20:30 UTC, about three hours after the release.
- WordPress 7.1.4 is released with security fixes backported to all branches eligible for security updates (back to 4.7), including a fix for the unauthenticated RCE in the core update process reported by Umut Bayram.
- Over the first 21 hours after release, Wordfence records more than 18,500 requests targeting staged installer (setup-config.php) paths; two major sources repeatedly poll for about 14.5 hours.
- Cyber Security News reports active exploitation of the WordPress core RCE hours after the patch; the number of compromised sites is not established.
- Scheduled date for the Wordfence firewall rule to reach free-tier users (Premium, Care and Response customers received it immediately).
Sources cited for Active Exploitation of WordPress Core Unauthenticated
- Hackers Actively Exploiting WordPress Remote Code Execution Flaw Just Hours After Patch Release
- WordPress 7.1.4 Security Release
- WordPress 7.1.4: 22 security fixes, upgrade directory RCE analysis (Patchstack)
- WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability
- WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
Detection coverage for TL-2026-4804
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4804 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.