The security company Wordfence has been recording targeted attack attempts since October 28 on a serious security vulnerability that WordPress closed with version 7.1.4. In the first 21 hours, Wordfence counted more than 18,500 requests to the installation file that briefly sits in the wp-content/upgrade/ folder during an update. All sites from version 4.7 onward that have not yet installed a patch release of their series are at risk.
How do the attackers proceed?
The vulnerability lies in the update process itself. During a full update, WordPress unpacks the new package together with the installer into a subfolder of wp-content/upgrade/, whose name was predictable up to version 7.1.3. If an attacker calls the file setup-config.php there at the right moment, they can execute their own PHP code on the server via the freshly unpacked copy. Wordfence rates the vulnerability at 8.1 out of 10 points on the CVSS scale, the usual yardstick for the severity of security vulnerabilities.
In lab tests, according to Wordfence, the window of opportunity was open for only seconds, so a single request has little chance of success. The attackers therefore rely on persistence: Two of the senders with the most requests repeatedly queried the same small groups of websites for around 14.5 hours, while others tried out many variants of folder and version names. Nine minutes after Wordfence had activated a new firewall rule, it triggered for the first time.
The attack attempts in numbers
Measurements from Wordfence from October 28, 2026, the release date of WordPress 7.1.4
- >18.500requests to the installation file in the first 21 hours
- 9 min.until the new firewall rule triggered for the first time
- 14,5 htwo senders repeatedly queried the same websites
- 8,1out of 10 points on the CVSS scale for the severity of security vulnerabilities
Not every request targeted exactly the vulnerable path
Source: Wordfence
Patchstack had still classified the attack on October 28 as difficult to carry out in practice. Wordfence's figures show that attackers are trying it anyway. Wordfence has so far not reported any successful break-ins.
Does a firewall protect you?
Only partially. On October 28 at 9:30 p.m. German time, about three hours after the update was released, Wordfence rolled out a firewall rule against the attack. Customers of Wordfence Premium, Care and Response received the rule immediately, while users of the free version get it, as usual, only after 30 days, that is, on November 27, 2026.
The rule can only work in Extended Protection mode. The attack calls the PHP file directly without loading WordPress; a firewall that only starts together with WordPress does not intercept this request. Patchstack had described the same limitation for firewalls that run as an ordinary plugin. In Wordfence's firewall area, the "Protection Level" entry shows which mode is active. The rule does not replace the update, Wordfence stresses.
What this means for you
It's best to check right away under Dashboard > Updates whether your site is using 7.1.4 or the patch release of its series, such as 7.0.8 or 6.9.11. Automatic updates usually install the update on their own, but Wordfence still recommends a check. The list of all patch releases can be found in the TutKit report on the update from October 29.
If you use the free version of Wordfence, the new rule only takes effect from November 27. Until then, you are left with the update and blocking the wp-content/upgrade/ folder directly on the web server. If a file listing appears when you open your address with the suffix /wp-content/upgrade/, ask your host to lock down the directory.
If your site was still running without the update since October 28, it is worth looking for traces of a break-in. As warning signs, Wordfence lists unknown PHP files under wp-content/upgrade/, foreign administrator accounts and plugins that nobody on your team installed. How to restore a site from backups in an emergency is shown in the lesson on security and backups in the course "WordPress for Beginners".
Wordfence published its analysis on October 29, 2026.
Sources
