The bug allows unauthenticated code execution during core upgrades. Wordfence blocked about 12,600 attacks in 24 hours and the federal patch deadline is 6 Nov