WordPress Just Patched a Flaw in Its Own Update Process. Here’s Why Attackers Are Waiting for Your Next Update

On October 28, 2026, WordPress released version 7.1.4, a security update that fixes 22 vulnerabilities. Most of them require an attacker to already have an account on your site. One doesn’t. It’s a weakness in WordPress’s own update process, and within hours of the fix going public, attackers were already scanning sites trying to take advantage of it.

The twist: the risk shows up while your site is updating. Here’s what’s going on and what to do.

What Happened?

When WordPress updates itself, it briefly unpacks a fresh copy of WordPress into a temporary folder on your server (wp-content/upgrade/). On many servers, that folder can be reached from the public internet like any other part of your site.

Before 7.1.4, the name of that temporary folder was predictable. So for the few seconds an update runs, a complete copy of WordPress, including its setup installer, sat at a location an outsider could guess. An attacker who reached it at exactly the right moment could, in the worst case, run their own code on your server, without any username or password. Security researchers call this kind of timing attack a “race condition.”

WordPress 7.1.4 fixes this by giving the temporary folder a random, unguessable name, among other safeguards.

How serious is it? Sources differ, so here’s the honest picture:

• Wordfence rates it High, 8.1 out of 10 (CVSS), affecting WordPress versions 4.7 through 7.1.3.
• Patchstack notes the attack window is “tiny” and would not call it practical to exploit, but stresses that it needs no account, and that the window returns on every update, including automatic ones.
• WordPress’s own advisory (GHSA-4w3m-c66w-69mg) rates it “Low.” No CVE number has been assigned yet.

Attackers Are Already Trying

Here’s why it still deserves your attention:

• Wordfence said its new firewall rule caught its first attack attempt nine minutes after it was deployed.
• In the first 21 hours, it recorded more than 18,500 requests looking for the temporary installer files, and it blocked 62,969 attack attempts in 24 hours.
• Two of the largest attackers repeatedly checked small groups of sites for about 14.5 hours, which looks like waiting for an update to start.

The good news: as of October 30, Wordfence has not reported any successful break-ins. Attackers are clearly trying, though, so this isn’t the time to put off updating.

Who Is Affected?

Any WordPress site running version 4.7 through 7.1.3 where the wp-content/upgrade/ folder is reachable from the web. Besides 7.1.4, WordPress released fixed versions for older branches:

WordPress only actively supports the newest version, so the safest place to be is 7.1.4.

Why This Matters for Your Business

Many business owners assume, “Automatic updates are on, so I’m covered.” Updates are essential, but this flaw is a good example of why they’re not the whole story. The risk window opens during the update itself, and that includes the update that installs the fix.

A compromised site can:

• Redirect visitors to scam or malware pages
• Expose customer data from forms, orders, or accounts
• Get flagged by Google as hacked, hurting your rankings

There’s another catch. According to Patchstack, a typical WordPress security plugin may not be able to block this attack, because the temporary copy of WordPress runs on its own and doesn’t load your site’s plugins. (Wordfence reports its firewall has blocked attempts, but that depends on how it’s set up, so don’t count on a plugin alone.) The dependable protection is a rule set on the web server itself, which most business owners never touch.

How to Fix It: Step-by-Step

1. Back up your site first.
Take a full backup of your files and database, and store a copy off your server.

2. Check your WordPress version.
In your dashboard, go to Dashboard → Updates (or Tools → Site Health → Info) to see which version you’re running.

3. Update to WordPress 7.1.4 (or your branch’s fixed version).
Click Update Now on the Updates screen. If you have automatic updates turned on, don’t assume they ran. Confirm that the version number actually changed.

4. Block public access to the upgrade folder at the server.
This is the key extra step security researchers recommend. Your web server should deny all outside access to /wp-content/upgrade/, and that folder should never show a list of its files in a browser. This rule belongs in your server or site configuration, not in a plugin. If you’re not comfortable editing server settings, ask your host or developer to do it.

5. If you’re on a very old version, plan an upgrade.
Sites on 4.6 or older get no fix at all, and older patched branches are no longer actively supported. Test the upgrade on a staging copy first, since old themes and plugins can break.

6. Check for signs of trouble.
Look for unfamiliar administrator accounts, plugins you didn’t install, or unexpected PHP files. If your host provides access logs, check for unusual requests to files under wp-content/upgrade/. If anything looks wrong, restore a clean backup and change all passwords.

7. Review who has accounts on your site.
Most of the other issues fixed in 7.1.4 require a logged-in user, often a Contributor or higher. Remove old accounts and give each person the lowest role they need.

Don’t Want to Deal With This Yourself? Let Me Handle It.

Flaws like this are a reminder that “auto-updates are on” isn’t a security plan. Real protection includes server-level settings that plugins often can’t reach, and someone keeping watch.

That’s what I do. With my managed WordPress hosting and security maintenance, you get:

• Server-level hardening, including rules like blocking public access to the WordPress upgrade folder
• WordPress core, plugin, and theme updates, applied and verified, not just assumed
• Automatic off-site backups, so your site can be restored quickly
• 24/7 uptime and security monitoring, so problems get caught early
• Regular malware scans and firewall protection
• Incident response. If something goes wrong, I clean it up and get you back online.

You focus on running your business. I’ll keep your website secure, up to date, and online.

Not sure if your site is protected? Contact me for a free WordPress security check, and let’s make sure your website is in good hands.