CYBUNKR

WordPress flaw lets attackers run code during a core update, and they are already trying

Published

WordPress 7.1.4 fixes CVE-2026-119977, which lets anyone run code on a site in the seconds it spends unpacking a core update. Wordfence saw attackers polling for it within minutes of its firewall rule. Check your version today.

If your website runs on WordPress, check today that it has updated to 7.1.4 (or the security release for its branch). WordPress released it on 28 October and recommends updating immediately (WordPress). The most serious of its fixes, CVE-2026-119977, lets an attacker who has not logged in run code on the server while WordPress is unpacking a full core update (CVE record).

The window is short, seconds in Wordfence's lab, but attackers are polling sites repeatedly to catch it (Wordfence).

Who is affected

  • WordPress 4.7 to 7.1.3. The fix is in 7.1.4 and was backported to every branch back to 4.7 (CVE record). Patched versions include 7.1.4, 7.0.8, 6.9.11, 6.8.12 and 6.7.11 (Wordfence).
  • The cause: during a full-package update WordPress unpacked the new files, including its installer, into a predictable folder under wp-content/upgrade that many servers make reachable from the web (Wordfence). Wordfence rates it 8.1 out of 10, high rather than critical, because the attacker has to win that race (CVE record).
  • WordPress 4.6 and earlier no longer get security updates at all (Wordfence).
  • The same release fixes other issues too, 22 in all, many of which need a contributor, author or editor login (WordPress 7.1.4 release notes, Wordfence).

What has been seen so far

A snapshot from 1 November:

  • Wordfence deployed a firewall rule on 28 October, about three hours after the release. The first match arrived nine minutes later, and it logged more than 18,500 requests for the staged installer in the first 21 hours (Wordfence).
  • Two of the largest sources polled small groups of sites for about 14.5 hours, which Wordfence says is consistent with trying to catch the update window (Wordfence).
  • We found no public exploit code or confirmed compromises yet. It is not in CISA's Known Exploited Vulnerabilities catalog, and CIRCL's Vulnerability-Lookup shows only social media mentions.

What to do

  • Check, don't assume. Most sites get the update automatically, but Wordfence advises going to Dashboard > Updates to confirm the site is on 7.1.4 or the patched release for its branch (Wordfence).
  • On WordPress 4.6 or earlier, upgrade to a supported release.
  • Don't rely on a security plugin instead of the update. Wordfence Free users only get its firewall rule on 27 November, and the attack requests a PHP file directly, so the firewall needs Extended Protection turned on to see it (Wordfence).
  • If the site stayed unpatched, look for requests to PHP files under wp-content/upgrade, administrator accounts, plugins or PHP files you didn't add (Wordfence).
  • Site run by an agency or host? Ask them which version each of your sites is on today.

How we can help

If you think your website has been compromised, our Incident Response service can help, or get in touch.

Sources