Race to Exploit: How Attackers Launched 63,000 WordPress RCE Attempts in Under 24 Hours
On October 28, 2026, WordPress released version 7.1.4 to patch a high-severity unauthenticated remote code execution vulnerability affecting WordPress Core versions 4.7 through 7.1.3 (CVSS 8.1). The flaw stems from predictable, web-accessible staging paths used during full-package core upgrades, allowing attackers to interact with a staged WordPress installer during the brief update window. Within 24 hours of patch release, Wordfence blocked 62,969 exploitation attempts, with multiple threat actors polling vulnerable paths such as setup-config.php for up to 14.5 hours in an effort to win the race condition and achieve server-side PHP code execution. This incident underscores the growing trend of near-instant weaponization of disclosed vulnerabilities, where threat actors reverse-engineer patches within hours and launch coordinated, automated scanning campaigns at scale. The race-condition exploitation pattern and sustained polling behavior reflect increasingly sophisticated attacker automation targeting CMS platforms that underpin millions of business websites globally.
Kill Chain
