{"id":"TECH-202610-unpatched-wordpress-sites-4-7-to-7-1-3-can-be-taken-over-dur","kind":"technique","aliases":[],"related":[],"title":"Unpatched WordPress sites (4.7 to 7.1.3) can be taken over during a core update: attackers race to hit the installer in wp-content/upgrade (no CVE)","description":null,"summary":"WordPress Core 4.7 through 7.1.3 unpacks full-package core updates into a predictable, often web-reachable folder under wp-content/upgrade, including the installer (setup-config.php). An unauthenticated attacker who requests the staged installer during the seconds-long update window can get PHP code execution on the server (Wordfence, CVSS 8.1, no CVE yet; reported by Umut Bayram). Fixed on 2026-10-28 in 7.1.4 and backports down to 4.7.39. Wordfence saw the first attack 9 minutes after deploying its rule and blocked 62,969 attempts in 24 hours, with some sources polling sites for about 14.5 hours. Successful compromises are not publicly confirmed. At risk: self-hosted WordPress sites that have not yet updated, since their next full core update opens the window.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-30T14:35:51+00:00","products":[{"name":"WordPress","fixed":["7.1.4","7.0.8","6.9.11","4.7.39"],"affected":">= 4.7, < 7.1.4","ecosystem":"wordpress"}],"ecosystems":[],"tags":["early-warning","technique","wordpress"],"not_affected_if":[],"how_to_check":"Check the WordPress version (wp core version); affected if 4.7 to 7.1.3 without the 2026-10-28 backport (fixed: 7.1.4, 7.0.8, 6.9.11 ... 4.7.39). In web server logs, look for requests to PHP files under /wp-content/upgrade/ (especially setup-config.php or install.php). Look for unfamiliar administrator accounts, plugins or PHP files.","fix":"Update WordPress Core to 7.1.4 or the patched release for your branch now. Block web access and PHP execution under wp-content/upgrade at the web server. If logs show requests to wp-content/upgrade PHP files during an update, check for new admin users, plugins and PHP files.","status":"open","published_at":null,"first_seen_at":"2026-10-30T14:35:51+00:00","triaged_at":"2026-10-30T14:35:51+00:00","updated_at":"2026-10-30T14:35:51+00:00","category":"package","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-1':38A '-10':116B '-202610':29A '-28':117B '-3':39A '-7':35A,37A '/upgrade':25A,75B '14.5':151B '2026':115B '24':142B '4':34A '4.7':4A,54B '4.7.39':124B '62':138B '7.1.3':6A,56B '7.1.4':119B '8.1':105B '9':130B '969':139B 'attack':15A,82B,129B 'attempt':140B 'backport':121B 'bayram':112B 'be':42A 'block':137B 'can':41A 'can-be-taken-over-dur':40A 'code':98B 'compromis':154B 'confirm':158B 'content':24A,74B 'core':13A,53B,61B,175B 'cve':27A,107B 'cvss':104B 'deploy':133B 'dur':45A 'earli':48B 'early-warn':47B 'execut':99B 'first':128B 'fix':113B 'folder':70B 'full':59B,174B 'full-packag':58B 'get':96B 'hit':18A 'host':163B 'hour':143B,152B 'includ':76B 'instal':20A,78B,87B 'long':92B 'minut':131B 'next':173B 'often':66B 'open':177B 'over':44A 'packag':60B 'php':97B 'poll':147B 'predict':65B 'public':157B 'race':16A 'reachabl':69B 'report':109B 'request':84B 'risk':160B 'rule':135B 'saw':126B 'second':91B 'seconds-long':90B 'self':162B 'self-host':161B 'server':102B 'setup-config.php':79B 'sinc':171B 'site':3A,148B,165B 'sites':33A 'sourc':146B 'stage':86B 'success':153B 'taken':9A,43A 'tech':28A 'techniqu':50B 'to':36A 'umut':111B 'unauthent':81B 'unpack':57B 'unpatch':1A 'unpatched':31A 'unpatched-wordpress-sites':30A 'updat':14A,62B,93B,170B,176B 'warn':49B 'web':68B 'web-reach':67B 'window':94B,179B 'wordfenc':103B,125B 'wordpress':2A,32A,46A,51B,52B,164B 'wp':23A,73B 'wp-content':22A,72B 'yet':108B,169B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-unpatched-wordpress-sites-4-7-to-7-1-3-can-be-taken-over-dur","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T14:35:51+00:00","fetched_at":"2026-10-30T14:35:51+00:00","note":null}],"documents":[{"id":23854,"url":"https://x.com/TheHackersNews/status/2116170573214880245","title":"@TheHackersNews: 🚨 Nearly 63,000 attack attempts target a WordPress RCE flaw in just 24 hours.\n\nA","kind":"post","source":"x","publisher":null,"text":"🚨 Nearly 63,000 attack attempts target a WordPress RCE flaw in just 24 hours.\n\nAttackers are repeatedly probing upgrade paths, trying to catch a brief window during core updates that could allow unauthenticated code execution.\n\nDetails ↓ https://t.co/vMtnK0iHFP\n\nlikes 131 reposts 38","published_at":"2026-10-30T14:09:15+00:00","relation":"describes","confidence":null,"note":null},{"id":23989,"url":"https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html","title":"WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours","kind":"blog","source":"analyst","publisher":null,"text":"WordPress Core 4.7 through 7.1.3: unauthenticated RCE (no CVE, CVSS 8.1, Wordfence) via predictable web-accessible staging directory under wp-content/upgrade during full-package core updates; staged copy includes installer (setup-config.php). Patched Oct 28 2026 in 7.1.4 and backports (7.0.8, 6.9.11 ... 4.7.39). Wordfence blocked 62,969 attacks in 24h; two sources polled small groups of sites for ~14.5 hours. Conditions: full-package update with installer files, public web+PHP access to staging tree, predictable/discovered staging path, enough time before cleanup. Advice: update to 7.1.4, look for suspicious requests to PHP files under wp-content/upgrade, unfamiliar admin accounts, plugins or PHP files. Researcher Umut Bayram. Wordfence firewall rule 20:30 UTC Oct 28 for paid users; free users Nov 27 2026. Successful compromises not publicly confirmed.","published_at":"2026-10-30T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}