# Active Exploitation of WordPress Core Unauthenticated Upgrade-Window RCE (Versions 4.7 through 7.1.3) Hours After 7.1.4 Patch Release

> A race-condition flaw in the WordPress core update process exposes a predictable, browsable staging folder under wp-content/upgrade that holds a full WordPress install, letting unauthenticated attackers reach wp-admin/setup-config.php during the seconds-long update window. Wordfence recorded more than 18,500 requests aimed at staged installer paths in the first 21 hours after the 7.1.4 release (2026-10-28); how many sites were compromised is not established.

- **Published:** 2026-10-30T06:32:55Z
- **Last reviewed:** 2026-10-30T07:27:15.383Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4804
- **ID:** TL-2026-4804
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WordPress 7.1.4, released on 2026-10-28, fixes an unauthenticated remote code execution weakness in the core update process reported by researcher Umut Bayram. It affects WordPress Core 4.7 through 7.1.3; the fixes were backported to every branch eligible for security fixes (patched releases reach back to 4.7.39). No CVE identifier has been published in the sources reviewed.

During a Core update that uses a complete WordPress package, affected versions unpack the new files into a predictable directory beneath wp-content/upgrade. Patchstack's analysis describes this as a guessable and browsable path holding a complete WordPress install. That copy includes wp-admin/setup-config.php, which boots on its own without the site's configuration. Cleanup that removed index.php could also leave the folder listable. An attacker who reaches the staged installer during the update could run setup against a database they control, inside the victim's document root, creating a path to code execution. Exploitation needs no WordPress account but requires the web server to allow public access and PHP execution under wp-content/upgrade, and the attacker must request the right path while an update is running. Lab testing showed the staging folder remains reachable for only seconds, so exploitation is a race that depends on repeated automated polling. Patchstack scored the issue AC:H and does not call it practical to exploit.

Wordfence deployed a firewall rule at 20:30 UTC on 2026-10-28, about three hours after the release. The first matching request arrived nine minutes later. Over the first 21 hours Wordfence recorded more than 18,500 requests targeting staged setup-config.php installer paths, and two major sources repeatedly polled for roughly 14.5 hours. The reporting does not say how many sites were breached, and it names no threat actor, malware, or network infrastructure.

The 7.1.4 fix appends 16 random characters to the temporary folder name, restores index.php protection (it is no longer deleted between updates), and stops wp-config.php from being copied from the working directory. WordPress 7.1.4 also contains other security fixes (stored XSS in several components, an Interactivity API denial of service, and unauthenticated discovery of unpublished Customizer changesets); the release announcement lists 13 items, while press coverage counts 22 flaws across 17 advisories.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter

## Sources

- [Hackers Actively Exploiting WordPress Remote Code Execution Flaw Just Hours After Patch Release](https://cybersecuritynews.com/wordpress-rce-exploited/)
- [WordPress 7.1.4 Security Release](https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- [WordPress 7.1.4: 22 security fixes, upgrade directory RCE analysis (Patchstack)](https://patchstack.com/articles/wordpress-7-1-4-security-release/)
- [WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability](https://cybersecuritynews.com/wordpress-7-1-4-fixes-security-flaws/)
- [WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release](https://malware.news/t/wordpress-7-1-4-patches-unauthenticated-upgrade-window-rce-exploitation-attempts-detected-after-release/126880)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4804