WordPress Core RCE flaw draws tens of thousands of exploit attempts

2026-11-01 · Cybersecurity

Threat actors have been attempting to exploit a high-severity remote code execution flaw in WordPress Core since patches were released, with roughly 63,000 attack attempts recorded in 24 hours. The vulnerability, which has no CVE identifier, affects WordPress Core versions 4.7 through 7.1.3 and carries a CVSS score described as high severity; SecurityWeek characterized it as an unauthenticated race condition leading to remote code execution. Separate research on the PHP2Shell attacks found that the critical PHP flaws being exploited root Palo Alto firewalls but fail against WordPress. With WordPress powering a large share of the web, rapid exploitation of unpatched sites is the immediate concern for site operators and hosting providers.

Why it matters：WordPress underpins a large share of the public web, so a fast-spreading unauthenticated RCE puts millions of site operators and hosting providers on a patching clock.

Key points

• Around 63,000 exploit attempts were logged within 24 hours of patching.
• The flaw affects WordPress Core versions 4.7 through 7.1.3 and has no CVE ID.
• PHP2Shell research found the related PHP flaws root Palo Alto firewalls but fail against WordPress.

Sources (original reporting)

• The Hacker News
• SecurityWeek

More stories from this day

• CISA flags actively exploited GitLab and Ivanti flaws
• Syrian Electronic Army hacker sentenced to 42 months in US
• Chainalysis discloses breach via "offensive agentic" attack
• TeamViewer patches flaw letting remote hosts attack technicians
• French lawmakers approve traffic-based internet tax on big platforms
• FBI blames North Korea for $6.3bn Binance hack; exchange says 90% covered