WordPress sites came under rapid, large-scale probing last week after security researchers disclosed a vulnerability in WordPress Core that can be exploited without any account credentials. Firewall vendor Wordfence recorded attack traffic beginning on October 28, 2026 — the very same day WordPress shipped the patch — and tracked more than 240,000 exploitation attempts in the days that followed, with activity peaking at over 74,000 blocked requests in a single day.

The flaw, tracked as CVE-2026-11997, carries a CVSS severity score of 8.1 and affects WordPress Core versions from 4.7 through 7.1.3 — a span covering roughly a decade of releases. Researcher Umut Bayram is credited with the discovery.

A race against the clock, inside the update process itself

The vulnerability does not live in a plugin or theme, which is where most WordPress security problems originate. It lives in the Core upgrade mechanism itself. When a site performs a full WordPress upgrade, the platform extracts the new installation files into a temporary folder nested beneath the site’s /wp-content/upgrade/ directory. On vulnerable versions, the name of that folder is predictable enough that an attacker who knows (or guesses) it can reach the in-progress installer over the web, with no login and no user interaction required.

Because the folder only exists for the duration of the upgrade before cleanup removes it, exploitation depends on a race condition: the attacker has to request the right path at the right moment, while the temporary installer is still live. That timing requirement is exactly why the bug is dangerous but not trivial to weaponize at will — an attacker generally needs either a lucky window or a high volume of automated, repeated probing to land a hit.

What a successful hit actually gets an attacker

Reaching the exposed installer in time can let an attacker complete what looks like a legitimate, staged WordPress installation: creating a new administrator account and uploading PHP code of their choosing. From there, the attacker effectively owns the site, with the ability to:

• Plant persistent backdoors disguised as normal WordPress files
• Alter site content, redirect visitors, or inject malicious scripts
• Exfiltrate database contents, including user and customer data

It is worth stressing what the 240,000 figure does and does not represent. That number reflects exploitation attempts that Wordfence’s firewall detected and blocked at the network edge — not confirmed breaches, not successful code execution, and not a count of how many individual sites were actually compromised. High-volume automated scanning is a normal part of how opportunistic attackers operate against any widely disclosed CVE; most of these 240,000 knocks almost certainly landed on doors that were already closed, either because the site had already patched or because the race condition simply didn’t line up in the attacker’s favor.

What site owners should do now

WordPress addressed the flaw in its October 28 security release and backported fixes to older branches, meaning administrators do not necessarily need to jump to the newest major version to be protected — just to the patched release for whichever branch they run. Sites with automatic background updates enabled may already have received the fix silently, but WordPress recommends owners verify the update actually completed rather than assume it did.

For anyone who has not yet updated, Wordfence’s guidance is to block public web access to PHP files underneath /wp-content/upgrade/ as an immediate stopgap, noting that this mitigation requires the firewall’s more aggressive "Extended Protection" mode, since the staged installer files run outside WordPress’s normal file-loading path. That stopgap buys time, but it is not a substitute for installing WordPress 7.1.4 or the equivalent patched release for an older branch. WordPress also notes that only its very latest release receives ongoing active support, so sites lingering on old, unsupported branches remain exposed to this and future issues well after this particular wave of scanning dies down.