WordPress exploit attempts spike after patch release
Oct 30, 2026 · Summarized by Fundy Tech from 3 sources
Attackers are trying to exploit a WordPress Core race condition that can allow code execution during updates. Wordfence blocked 62,969 attacks in 24 hours.
Key points
- The flaw affects WordPress Core versions 4.7 through 7.1.3.
- Patches were released on October 28, 2026.
- Wordfence says the attack window is brief and requires timing during a core update.
Why it matters
If your business site runs WordPress, this could affect your public website while updates are installing. An attacker who wins the race can execute code on the server. Households running personal sites should also update quickly. The practical risk is website compromise, which can expose customer data, lock you out, or spread malicious files.
Who’s affected: WordPress Core sites from 4.7 to 7.1.3
What to do
- Update WordPress to 7.1.4 as soon as possible.
- Check for suspicious requests under wp-content/upgrade.
- Look for unfamiliar admin accounts, plugins, or PHP files.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.