Over 60,000 Attacks Target WordPress RCE Vulnerability Within 24 Hours

What happened?

Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24 hours. These are attack attempts, not confirmed website compromises, and the figure does not establish how many individual sites were targeted. WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The update closes the code execution weakness alongside stored cross-site scripting, information disclosure, and permission issues.

Key details

• WordPress 7.1.4 was released on October 28, 2026, fixing 22 security vulnerabilities including the RCE flaw.
• The patch adds random characters to temporary folder names, restores index.php protection, and prevents wp-config.php copying.
• Wordfence Premium, Care, and Response customers received a firewall rule three hours after release; free users get it after 30 days.
• Patched versions include 7.0.8, 6.9.11, and backports through 4.7.39; versions 4.6 and earlier no longer receive updates.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.