WordPress RCE flaw targets the update window

A remote code execution flaw in WordPress Core can let an unauthenticated attacker run code during a full-package update if the temporary directory is web-accessible. Wordfence says it blocked 62,969 attempts in 24 hours; a fix is available in version 7.1.4.

The attack hinges on racing cleanup: installer files are unpacked to a predictable path under wp-content/upgrade, and attackers are repeatedly probing files such as setup-config.php to catch the exposure window, which may last only seconds. The flaw affects versions 4.7 through 7.1.3.