WordPress's 7.1.4 upgrade-RCE patch is now under active attack
Wordfence logged over 18,500 attack requests in the first 21 hours after WordPress patched a core upgrade-process RCE, confirming exploitation the original release notes did not report.
WordPress patched a remote-code-execution bug in its own upgrade process on 28 October, in version 7.1.4. Two days on, Wordfence says it is being actively exploited, something the original release notes did not report.
The bug is a race condition: during a core update, WordPress briefly unpacks an installer into a predictable folder under wp-content/upgrade, and on some server setups that folder stays reachable over the web and able to execute PHP for a few seconds while the update runs. Wordfence deployed a blocking firewall rule at 20:30 UTC on 28 October, three hours after the release went out. The first matching attack arrived nine minutes later. Over the following 21 hours, Wordfence logged more than 18,500 requests against staged setup-config.php installer paths, including one source that kept probing for roughly 14.5 hours. WordPress 7.1.4 fixes it by randomising the staging directory name and adding an index guard.
Why it matters: this affects every WordPress install regardless of which plugins are running, and attackers found it within hours of the patch going out. If you haven’t updated past 7.1.3, do it now rather than on your usual schedule, and check that wp-content/upgrade isn’t web-listable on your server as a second line of defence.
The caveat: exploitation needs the attacker to catch a window of only a few seconds during a live update, so it isn’t trivially reliable. Automated, high-volume scanning just means that window gets hit anyway.