Zero Radar
← feed
HighVulnerabilityupdated 30 Oct 2026, 16:42 UTC

WordPress Core flaw lets attackers run code on sites, attacks underway

A bug in WordPress itself could let an outsider take control of a website without logging in. Attackers have started trying to use it within hours of the fix being released.

Attacks reported (The Hacker News, SecurityWeek)Fix available · out 2 independent sources
SeverityHighVulnerability
Being exploited?ReportedBy The Hacker News, SecurityWeek, not officially confirmed yet
Fix available?YesPatches were released in October 2026; the exact fixed version is not stated in the provided material. · since 30 Oct 2026
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker scans sitesTargets sites on affected WordPress versions
  2. 2Sends crafted requestsExploits a race condition without logging in
  3. 3Server runs attacker codeRemote code execution on the web server
  4. 4Data and site at riskAttacker can read, change, or add content
  5. ResultAttacker gains control of the site

What happened

A high-severity unauthenticated race condition in WordPress Core allows remote code execution. The flaw has no CVE identifier and is rated CVSS 8.1.

Why it is dangerous: Successful exploitation would let an attacker run code on the server hosting the site, potentially exposing data or taking over the site. Any site running an affected WordPress version is at risk.

Are you affected?

You are affected if your site runs WordPress Core versions 4.7 through 7.1.3.

WordPress Core 4.7 through 7.1.3

What to do

  1. Update WordPress Core to the latest patched version immediately
  2. Check your WordPress version in the admin dashboard under Dashboard > Updates
  3. Review logs for unusual requests or unexpected files if the site was running an affected version

Timeline

  1. 30 Oct 2026, 12:04 UTC
    Publicly disclosed
  2. 30 Oct 2026, 12:12 UTC
    Picked up by Zero Radar
  3. 30 Oct 2026, 14:08 UTC
    Reported by The Hacker News · The Hacker News
  4. 30 Oct 2026, 16:42 UTC
    SecurityWeek reported on it · SecurityWeek

Sources 2 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-6473fc77 · ZR-3556a8b0
Disclosed
30 Oct 2026, 12:04 UTC
On Zero Radar
30 Oct 2026, 12:12 UTC (8 min after disclosure)
Last change
30 Oct 2026, 16:42 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WordPress Core flaw lets attackers run code on sites, attacks underway · Zero Radar