Act
active
WordPress Core RCE Exploited at Scale — 63k Attempts in 24 Hours
- Engineer — Act: WordPress Core versions 4.7–7.1.3 are under active exploitation at high volume; patch all WordPress instances to 7.1.4 or later immediately, and audit any public-facing WordPress sites for signs of compromise before patching is confirmed complete.
- SOC/IR — Act: The attack volume indicates opportunistic mass scanning; sweep WAF and web server logs for anomalous POST requests to WordPress Core endpoints since the patch release date, and treat any unpatched WordPress hosts as potentially compromised pending investigation.
- Leader — Act: WordPress is one of the most widely deployed platforms in enterprise web estates; confirm this week that all WordPress properties are patched and request a status report from engineering, as active exploitation at this scale raises the likelihood of a successful breach across your organization or supply chain.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.