# WordPress RCE flaw targets the update window

Canonical source : [WordPress RCE flaw targets the update window](<https://sebastien.rigaux.be/en/tech-watch/links/wordpress-rce-flaw-targets-the-update-window>)

A remote code execution flaw in WordPress Core can let an unauthenticated attacker run code during a full-package update if the temporary directory is web-accessible. Wordfence says it blocked 62,969 attempts in 24 hours; a fix is available in version 7.1.4.

The attack hinges on racing cleanup: installer files are unpacked to a predictable path under `wp-content/upgrade`, and attackers are repeatedly probing files such as `setup-config.php` to catch the exposure window, which may last only seconds. The flaw affects versions 4.7 through 7.1.3.

- Selected on : 2026-10-31

- Resource publication : 2026-10-30

- Entry updated : 2026-11-07T20:32:37+0000

- Format : Article

- Source language : EN

- Credit : The Hacker News

Original resource : [WordPress RCE flaw targets the update window](<https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html?m=1&fbclid=IwVERDUAVSgZFleHRuA2FlbQIxMQBwZG9mBWZkaWQWURVldsH84Prb_V9O7MJ8RzmvQSBsuHNydGMGYXBwX2lkCjY2Mjg1NjgzNzkAAR8-ptU2QLdLnxH-DOwi8ZTpvDQvoHH5ARUtADcS_XgLJpuQ6RDMlL_aD1TW9g_aem_-NUl7MFU_kQudSHH6dvgVQ>)

Tags : [Security](<https://sebastien.rigaux.be/en/tech-watch/tags/security>)

Available versions : [Français](<https://sebastien.rigaux.be/veille/liens/wordpress-une-faille-rce-exploite-la-fenetre-des-mises-a-jour>) · [English](<https://sebastien.rigaux.be/en/tech-watch/links/wordpress-rce-flaw-targets-the-update-window>)

[Back to tech watch](<https://sebastien.rigaux.be/en/tech-watch>)