Nearly 63,000 Attack Attempts Target WordPress RCE Flaw Hours After Patch Release

According to reports from The Hacker News, threat actors began exploiting a remote code execution vulnerability in WordPress Core shortly after patches were released in October 2026. The flaw impacts WordPress Core versions 4.7 through 7.1.3 and carries a CVSS score of 8.1. Notably, the vulnerability does not have a CVE identifier assigned.

In the 24 hours following the patch release, nearly 63,000 attack attempts were observed, indicating that actors are actively scanning for and attempting to exploit the flaw before or immediately after updates are deployed. The exploitation activity targets WordPress installations globally.

Automattic, the company behind WordPress, has released patches to address the vulnerability. Security advisories urge all WordPress users to update to versions beyond 7.1.3 as soon as possible to mitigate the risk of compromise. The rapid exploitation activity following patch release highlights a common challenge in cybersecurity: the window between patch availability and widespread update deployment.