---
id: "TECH-202610-unpatched-wordpress-sites-4-7-to-7-1-3-can-be-taken-over-dur"
kind: "technique"
aliases: []
title: "Unpatched WordPress sites (4.7 to 7.1.3) can be taken over during a core update: attackers race to hit the installer in wp-content/upgrade (no CVE)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "WordPress", "fixed": ["7.1.4", "7.0.8", "6.9.11", "4.7.39"], "affected": ">= 4.7, < 7.1.4", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["early-warning", "technique", "wordpress"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-30T14:35:51+00:00"
updated_at: "2026-10-30T14:35:51+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-30T14:35:51+00:00"}]
---

# Unpatched WordPress sites (4.7 to 7.1.3) can be taken over during a core update: attackers race to hit the installer in wp-content/upgrade (no CVE)

WordPress Core 4.7 through 7.1.3 unpacks full-package core updates into a predictable, often web-reachable folder under wp-content/upgrade, including the installer (setup-config.php). An unauthenticated attacker who requests the staged installer during the seconds-long update window can get PHP code execution on the server (Wordfence, CVSS 8.1, no CVE yet; reported by Umut Bayram). Fixed on 2026-10-28 in 7.1.4 and backports down to 4.7.39. Wordfence saw the first attack 9 minutes after deploying its rule and blocked 62,969 attempts in 24 hours, with some sources polling sites for about 14.5 hours. Successful compromises are not publicly confirmed. At risk: self-hosted WordPress sites that have not yet updated, since their next full core update opens the window.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:WordPress affected >= 4.7, < 7.1.4 fixed 7.1.4, 7.0.8, 6.9.11, 4.7.39

## How to check

Check the WordPress version (wp core version); affected if 4.7 to 7.1.3 without the 2026-10-28 backport (fixed: 7.1.4, 7.0.8, 6.9.11 ... 4.7.39). In web server logs, look for requests to PHP files under /wp-content/upgrade/ (especially setup-config.php or install.php). Look for unfamiliar administrator accounts, plugins or PHP files.

## Fix

Update WordPress Core to 7.1.4 or the patched release for your branch now. Block web access and PHP execution under wp-content/upgrade at the web server. If logs show requests to wp-content/upgrade PHP files during an update, check for new admin users, plugins and PHP files.

## Timeline

- 2026-10-30T14:35:51+00:00 analyst

## Documents

- [describes] @TheHackersNews: 🚨 Nearly 63,000 attack attempts target a WordPress RCE flaw in just 24 hours.

A https://x.com/TheHackersNews/status/2116170573214880245
- [describes] WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_