Attackers are already probing a newly patched WordPress core flaw that can allow unauthenticated remote code execution during a site upgrade, according to Wordfence. The issue, tracked as CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3 and was addressed in WordPress 7.1.4 and corresponding backported security releases released on October 28, 2026.
What the WordPress core vulnerability allows
The vulnerability is described as an upgrade-window race condition in WordPress core. In practical terms, an attacker would need to hit a site while a core upgrade is actively in progress, when predictable staging files are exposed under /wp-content/upgrade/.
If that timing lines up, the attacker may be able to run code on the server without authentication. Wordfence warns that successful exploitation can lead to full site compromise, including backdoors, content tampering, and data theft.
Why the attack is difficult, but still dangerous
Despite the high severity, this is not the kind of flaw that can be exploited at any moment. It depends on a narrow upgrade window, and the attacker must complete the chain before the staging directory is removed.
That limitation makes real-world exploitation harder, but it has not stopped automated attempts. Wordfence says its records show attacker activity began on the same day the flaw was disclosed, October 28, 2026.
Observed attack pattern
Wordfence says the requests it has seen target installer files in the predictable staging directory, including paths such as /wp-content/upgrade/wordpress-6.9.11/setup-config.php. Those files are part of the upgrade process and should not be reachable by outside users during normal operation.
If the installer is reachable, an attacker may try to complete the staged installation, create an administrator account, and upload malicious PHP code. That can give them persistent access to the server.
Wordfence blocking activity has surged
According to Wordfence, its firewall has already blocked more than 240,000 exploit attempts aimed at this vulnerability. The busiest period came between October 29 and November 1, 2026, with October 30 standing out as the peak day, when more than 74,000 attempts were blocked.
Wordfence noted that these numbers do not necessarily mean a large number of sites were successfully compromised. Most of the traffic appears to be automated scanning aimed at catching a site in the middle of an upgrade.
Top offending IP addresses reported
- 103.59.160.171 — over 74,900 blocked requests
- 2001:df1:e8c0::106b — over 40,400 blocked requests
- 51.89.103.78 — over 34,600 blocked requests
- 185.177.72.61 — over 4,400 blocked requests
- 195.3.220.7 — over 2,900 blocked requests
- 96.62.218.148 — over 2,300 blocked requests
- 20.217.186.29 — over 2,000 blocked requests
- 87.58.197.83 — over 2,000 blocked requests
- 154.26.238.8 — over 1,800 blocked requests
- 20.46.43.126 — over 1,700 blocked requests
Who is protected and when
Wordfence says Premium, Care, and Response users received a firewall rule for known exploit attempts on October 28, 2026. Free users are scheduled to receive the same protection on November 27, 2026.
The company also says customers using an optimized firewall in Extended Protection mode are already protected during the update process. Because the vulnerable files do not load WordPress, the firewall needs that mode to inspect and block the requests.
What site owners should do now
The most important step is to update WordPress to 7.1.4 or the appropriate patched security release for the site’s branch. WordPress sites with automatic background updates enabled should already have moved to a safe version.
Wordfence recommends acting quickly even though updating from a vulnerable version still runs the vulnerable upgrade process one last time. That exposure is brief and only applies during the update itself; once the patched version is installed, future upgrades are no longer affected.
Additional precautions recommended by Wordfence
- Block access to PHP files in
/wp-content/upgrade/at the web server level before updating, if possible. - Review web server access logs for requests to PHP files in the upgrade directory.
- Pay special attention to requests for
setup-config.php. - Check the
/wp-content/upgrade/directory for leftover files or folders after updating. - Review installed plugins and WordPress users for anything unexpected.
CISA has added the flaw to its KEV catalog
The vulnerability was added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on November 2, 2026, underscoring that it is being actively targeted in the wild. Wordfence researchers say the exploit attempts make it important for administrators to patch without delay.
For sites that show signs of compromise, Wordfence advises removing unexpected files, plugins, and administrator accounts, then checking for backdoors. It also warns that the absence of suspicious log entries does not guarantee a site was not affected.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: November 5, 2026 at 10:32 pm
0 views
