WordPress Core upgrade race condition draws nearly 63,000 code execution attempts in 24 hours

Wordfence blocked 62,969 attacks in 24 hours against a WordPress Core remote code execution flaw, rated 8.1 and tracked under GitHub advisory GHSA-4w3m-c66w-69mg with no CVE assigned. The flaw stems from predictable, web-accessible staging paths used during full-package core upgrades: new files, including the WordPress installer, are unpacked into a predictable wp-content/upgrade directory, and an unauthenticated attacker who requests the installer at the right moment can reach PHP code execution by winning a narrow race condition. It affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4, released October 28. Attackers are polling paths such as setup-config.php.

Check

Update WordPress Core to 7.1.4 now, and watch web logs for requests to wp-content/upgrade paths such as setup-config.php during and after upgrades.

Affected

WordPress sites on 4.7 through 7.1.3 expose a predictable upgrade staging path that an unauthenticated attacker can race to reach PHP code execution.

Fix

Apply WordPress 7.1.4, block external requests to wp-content/upgrade, and review sites for web shells or unexpected admin changes after the attack window.