Live › technique › TECH-202610-unpatched-wordpress-sites-4-7-to-7-1-3-can-be-taken-over-dur
WordPress Core 4.7 through 7.1.3 unpacks full-package core updates into a predictable, often web-reachable folder under wp-content/upgrade, including the installer (setup-config.php). An unauthenticated attacker who requests the staged installer during the seconds-long update window can get PHP code execution on the server (Wordfence, CVSS 8.1, no CVE yet; reported by Umut Bayram). Fixed on 2026-10-28 in 7.1.4 and backports down to 4.7.39. Wordfence saw the first attack 9 minutes after deploying its rule and blocked 62,969 attempts in 24 hours, with some sources polling sites for about 14.5 hours. Successful compromises are not publicly confirmed. At risk: self-hosted WordPress sites that have not yet updated, since their next full core update opens the window.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:35 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WordPress | wordpress | >= 4.7, < 7.1.4 | 7.1.4, 7.0.8, 6.9.11, 4.7.39 |
7.1.3 without the 2026-10-28 backport (fixed: 7.1.4, 7.0.8, 6.9.11 ... 4.7.39)7.1.4 or the patched release for your branch nowEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("TECH-202610-unpatched-wordpress-sites-4-7-to-7-1-3-can-be-taken-over-dur")