WordPress Upgrade Race Condition Draws 62969 Exploitation Attempts in 24 Hours

The vulnerability stems from WordPress unpacking core updates into a web-accessible staging directory that includes the installer. Unauthenticated attackers who time a request to setup-config.php during the narrow window can achieve PHP execution on the server. Wordfence recorded sustained polling from two large sources over 14.5 hours plus broader directory-version probing, confirming rapid attacker adaptation to the race condition. Successful exploitation requires public web access to the staging tree and insufficient cleanup timing.

Technical telemetry shows the flaw affects any site performing full core upgrades without hardened staging paths or immediate post-update directory removal. No CVE was assigned despite the 8.1 CVSS score and active exploitation evidence. Official patch notes emphasize version 7.1.4, yet procurement records for WordPress hosting platforms reveal inconsistent application of upgrade isolation controls across managed services.

Sites must audit wp-content/upgrade logs for anomalous PHP requests and verify absence of unexpected administrator accounts. Independent monitoring of similar staging mechanisms in other CMS platforms indicates this pattern recurs when update processes prioritize convenience over atomic isolation. Continued polling volumes above 50,000 daily will persist until 90 percent of vulnerable instances reach 7.1.4.