WordPress Core flaw: interpreting 62.969 blocked attack attempts
Wordfence reported blocking 62.969 attack attempts in 24 hours targeting a WordPress Core vulnerability. This measures attempts Wordfence says it blocked, not successfully compromised websites. The cited data does not es
Wordfence reported blocking 62.969 attack attempts in 24 hours targeting a WordPress Core vulnerability. This measures attempts Wordfence says it blocked, not successfully compromised websites. The cited data does not establish an exploitation success rate.
The vulnerability affects WordPress Core versions 4.7 through 7.1.3, has a CVSS score of 8,1, and has no CVE identifier. A patch was released on 28 October 2026. TMGS recommends updating affected installations to 7.1.4.
Why the upgrade window matters
During a Core update using a full package, affected versions extract files into a predictable directory under wp-content/upgrade. On many servers, this staging area is accessible through the web. An unauthenticated attacker reaching it at the right moment could interact with the staged WordPress installation and progress to PHP code execution on the server.
Wordfence emphasizes that successful exploitation requires hitting a very narrow window while the full Core update is being extracted. That condition limits what can be inferred from the attempt count. TMGS assesses that the short window does not justify lowering remediation priority when attack attempts have already appeared.
TMGS defensive recommendations
TMGS recommends inventorying WordPress websites, identifying affected versions, and prioritizing updates to 7.1.4. Prepare backups, recovery options, and post-update operational checks.
TMGS also recommends:
- Verify the running version after updating and record it in the asset inventory.
- Review suspicious requests to PHP files under
wp-content/upgrade, focusing on activity before, during, and after the upgrade. - Correlate requests with error logs and file changes before concluding that a compromise occurred.
- For outsourced website management, assign clear responsibilities across content administrators, hosting providers, and security teams. Record the final version, upgrade time, and contact responsible for access logs.
Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/wordpress-doc-dung-62-969-luot-tan-cong-bi-chan-i.d487a618-e176-4ef5-b74a-5dd1345f7d37
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.