WordPress Core RCE Flaw Hit With Nearly 63,000 Exploitation Attempts Within a Day of Patch Release

Threat actors moved quickly to exploit a high-severity remote code execution (RCE) vulnerability in WordPress Core, according to reporting from The Hacker News. The flaw has not been assigned a CVE identifier. It affects WordPress Core versions 4.7 through 7.1.3 and carries a CVSS score of 8.1. Patches were released in October. Attackers began probing for the vulnerability soon after. Nearly 63,000 attack attempts were observed within a 24-hour window.

Why It Matters

WordPress powers a large share of websites, so a flaw affecting a broad version range (4.7 through 7.1.3) means a large pool of potentially vulnerable installations. The high volume of exploitation activity so soon after the patch is consistent with a common pattern. Attackers study a fix to identify the underlying bug, then scan the internet for unpatched sites before administrators apply updates. An RCE in WordPress Core could allow full compromise of affected sites, so this is a priority patching item for any organization running self-hosted WordPress.

What Defenders Should Do Now

• Patch promptly. Confirm WordPress Core is updated past the fixed version. Verify the installed build rather than relying on version-range assumptions.
• Audit internet-facing WordPress sites for the affected version range (4.7 to 7.1.3), including sites managed by marketing, development, or third-party teams that may not be in regular patch cycles.
• Review web server and WAF logs for unusual POST requests, unexpected plugin or theme file writes, or unexpected PHP execution after the patch release.
• Hunt for post-exploitation indicators such as new admin users, unfamiliar scheduled tasks (WP-Cron), or modified core or theme files, in case exploitation occurred before patching.
• Restrict or monitor commonly abused WordPress entry points at the WAF layer while patches are rolled out.

Details on the specific vulnerable function and exploitation technique have not been fully disclosed, and no CVE identifier has been assigned. Read the original report from The Hacker News: WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours.