WordPress race condition RCE flaw is being targeted
Attackers are probing a new WordPress race condition that can end in remote code execution. See what to check on your sites.
TL;DR: A new WordPress bug, a race condition that needs no login and can end in remote code execution, is being probed by attackers.
What happened
SecurityWeek reported on October 30, 2026 that threat actors are attempting to exploit a fresh WordPress vulnerability. It is described as a high-severity race condition that needs no login and can lead to remote code execution. The short summary does not name the plugin or version, so read the vendor advisory for the release that fixes it.
Am I affected?
Any public WordPress site could be a target until you confirm which component is involved. To check one site by hand, run wp core version and wp plugin list in the site directory, then compare each version with the advisory. Update promptly, and watch web logs for bursts of identical requests from one address.
How to check with Stackurity
Stackurity finds WordPress sites as applications from wp-config.php or wp-includes/version.php. The WordPress core version itself is not reported yet, so check core by hand. Plugins that a repository lockfile pins are matched against advisories every hour.
Stackurity keeps a live inventory of installed packages through a read-only agent on Linux servers and matches it against new advisories every hour, using each distribution's own version rules so that backports are not reported as false alarms. After an upgrade, check again records whether the issue is really gone. Read how verification works. The core is open source, and Stackurity Cloud offers a 14-day free trial without a card: start a free trial.
