WordPress patched a remote code execution flaw in core on October 28, and attackers are already hammering it. Wordfence blocked 62,969 attempts in 24 hours.
The bug
Versions 4.7 through 7.1.3 unpack full-package core updates into a predictable folder under wp-content/upgrade, and that copy includes the installer. If the folder is reachable over the web, an attacker who hits the installer during the few seconds of an update can get to PHP code execution. It’s CVSS 8.1 and has no CVE yet.
That’s a narrow window, but attackers are polling paths like setup-config.php for hours to catch it.
What to do
- Update to 7.1.4 now.
- Check logs for requests to PHP files under
wp-content/upgrade. - Look for admin accounts, plugins or PHP files you don’t recognize.
I’ve got a short how-to in this batch on blocking web access to that folder.
God Bless, and Needs Garlic!
