WordPress vulnerability highlights shrinking window between patch and exploit

A critical security vulnerability in WordPress has highlighted the rapidly shrinking window between patch release and active exploitation. Following the release of WordPress 7.1.2 on September 22, Patchstack reported that probing traffic began within five hours, with exploitation attempts matching the exact encoding the patch was intended to fix. Experts noted that the gap between disclosure and exploitation has effectively collapsed, as attackers can now use the published patch itself as a guide to develop exploits.

This trend reflects a broader shift in the cybersecurity landscape. Data from Rapid7 shows that flaws now reach CISA’s Known Exploited Vulnerabilities (KEV) catalog in an average of five days, down from 8.5 days the previous year. Conversely, the median time for organizations to fully patch a KEV-listed flaw has increased to 43 days, according to Verizon’s 2026 Data Breach Investigations Report.

In response to these accelerating threats, CISA has updated its remediation requirements through Binding Operational Directive 26-04. Rather than using flat deadlines, remediation timelines now scale with risk, with high-risk cases requiring action within three days. As of mid-September, the KEV catalog contains 1,713 entries, with approximately 75% of new entries carrying a three-day due date.