AI analysis
Claude Opus · 6 Nov 2026, 10:20 CET
WordPress core upgrade race condition lets unauthenticated attackers run code
WordPress 4.7 through 7.1.3 can be compromised by unauthenticated attackers during full-package core upgrades. CISA confirms active exploitation. Upgrade to the patched release for your branch now and check sites for signs of compromise.
In plain terms
WordPress, the widely used website software, has a flaw in how it updates itself. During a full core upgrade, WordPress temporarily places files in staging locations, which are holding areas on the server. These locations are predictable and can be reached from the web. For a short time, an outsider who knows where to look could get the server to run their own code. That would give them control over the website and possibly the server underneath it.
This is a race condition: the attacker has to act within a narrow window while the upgrade is running. No login is needed. Anyone running a self-hosted WordPress site on versions 4.7 through 7.1.3 should treat this as urgent, because the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are using it.