More than 240,000 exploit attempts have targeted a serious security flaw in WordPress core that enables remote code execution—even without a login. The vulnerability, identified as CVE-2026-119977, was first reported by researcher Umut Bayram and affects WordPress versions 4.7 through 7.1.3. Its CVSS severity rating is 8.1, placing it among high-risk vulnerabilities.
The issue involves predictable temporary directories that WordPress creates during a full core upgrade. Specifically, during an upgrade the system extracts files into folders under /wp-content/upgrade/. Attackers can use known naming patterns to locate installer files still unpacked at moments when the update is in progress—before WordPress has completed its cleanup. This race-condition timing flaw allows attackers to reach code that hasn’t yet been removed. No WordPress account is required. The flaw allows for remote code to be executed, administrator access to be created, and malicious PHP files to be uploaded. Once exploited, sites could face backdoors, content tampering, or data theft.
Timeline & Observed Attack Activity
WordPress officially fixed the flaw with its October 28, 2026, security release. Patches were also backported to older supported branches. The change focused on altering how temporary folders are handled during updates, making it harder for attackers to predict or access installer files during upgrade windows.
Attack attempts began the same day the patch dropped—October 28—and peaked around October 30. Wordfence data shows its firewall blocked over 74,000 exploit requests that day. Though these are blocked requests—not confirmed successful exploits—the volume signals broad scanning activity. Sustained high activity ran from October 29 through November 1. These probing efforts, when automated and repeated, increase the risk of encountering vulnerable setups.
What You Should Do Now
If your WordPress installation is on any version from 4.7 up to 7.1.3, updating to version 7.1.4—or whatever the latest release is for your branch—is critical. Even if automatic background updates are enabled, verify they’re fully applied. WordPress only offers active support to its newest release, underscoring the importance of staying current.
Defense-in-depth is also advised. Block public access to PHP files under /wp-content/upgrade/ before performing upgrades. Doing so can prevent attackers from accessing staged files. Wordfence suggests enabling its Extended Protection mode to harden defenses during the upgrade process.
The vulnerability affects many sites simply because predictable folder names and overlapping timing windows during upgrades are standard behavior. The fact that over 240,000 attempts were logged in just days highlights how aggressively attackers exploit even small windows of opportunity.
Indicators of compromise include requests for setup-config.php in upgrade directories—especially paths like /wp-content/upgrade/wordpress-6.9.11/wp-admin/setup-config.php—and traffic originating from several known IPv4 and IPv6 addresses. Administrators should monitor server logs for these signs and act swiftly if they appear.
This issue stresses how even momentary oversights during software updates can expose sites to serious risk. Developers and admins should expect scrutiny and probing during patch releases—and build update routines that close predictable gaps. For WordPress users, the lesson is clear: keep versions current, avoid predictable folder paths during upgrades, and lock down file access until cleanups complete. These steps will matter more than ever during high-urgency patch windows.
