Attack attempts targeting a WordPress core remote code execution (RCE) vulnerability topped 60,000 in 24 hours, Cybersecurity News reported on Oct. 31.

The report said security firm Wordfence blocked 60,471 attack attempts over 24 hours. It said the figure is the number of attempts, not confirmed site compromises. The number of individual sites targeted cannot be determined from the figure.

WordPress released version 7.1.4 on Oct. 28, fixing 22 security vulnerabilities. The update addressed a code execution flaw as well as stored cross-site scripting (XSS), information exposure and permission issues.

The vulnerability targets a race condition. WordPress briefly creates temporary installation files during an upgrade. An attacker can link the installer to a database the attacker controls to run code on the server.

The window for an attack is usually only a few seconds. Attackers repeatedly send requests to catch the moment when the update files are exposed.

Users on older versions of WordPress should update to supported versions such as 7.0.8 and 6.9.11. Versions 4.6 and earlier no longer receive security updates. Even if automatic updates are enabled, users should check themselves whether installation has been completed.