WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

A critical remote code execution vulnerability in WordPress Core versions 4.7 to 7.1.3 has been actively exploited, with nearly 63,000 attack attempts detected within 24 hours of patch release on October 28, 2026. The flaw arises from predictable, web-accessible staging paths during full-package core upgrades, allowing unauthenticated attackers to execute code if they act within a narrow time window.