WordPress core RCE under active attack; Wordfence blocks 58,693 attempts
CVE-2026-119977 in WordPress 4.7 through 7.1.3 can yield unauthenticated PHP execution during brief upgrades; 7.1.4 patches it.
78
Organization
Wordfence
- Mentions · 7d7
- Mentions · 30d25
- All mentions42
- First seenAug 25, 2026
- Last mentioned1h ago
Timeline
42 articles · newest firstWordPress core RCE drew 60,471 attack attempts in 24 hours
Wordfence blocked the attempts after WordPress 7.1.4; the count does not show how many sites were compromised.
76
Attackers probe WordPress core race; 62,969 attempts in a day
Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.
78
Attackers target fresh WordPress core update flaw hours after patch
The unauthenticated race condition can yield remote code execution only during a short core-update window; Wordfence has not confirmed compromises.
80
WordPress 7.1.4 fixes 22 flaws, including RCE under attack
Wordfence says unauthenticated RCE in WordPress 4.7 through 7.1.3 drew more than 18,500 exploit requests in 21 hours; successful compromises are not confirmed.
78
WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack
Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.
84
Wordfence sees no confirmed WordPress compromises from PHP2Shell
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
74
PHP2Shell attack attempts continue with no confirmed compromises
Wordfence logged more than 74,000 related attempts; fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
84
PHP emergency updates fix two unauthenticated RCE flaws, CVSS 9.2
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; updating WordPress does not update PHP.
86
PHP patches two critical unauthenticated remote code execution flaws
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; WordPress updates do not patch PHP itself.
90
Stolen UpdraftCentral keys used to install malicious WordPress plugins
TeamUpdraft suspects an October 17-18 website breach exposed connection keys; 1.26.13 and 2.26.13 disconnect older links.
74
PHP schedules critical security release for October 21
Two flaws are each rated CVSS v4.0 9.2, but versions, fixes and CVE identifiers remain unpublished.
78
Trojanized Rank Math PRO 3.0.123 planted website backdoors
Only downloads from a roughly 11-hour window were affected; the vendor shipped clean version 3.0.124.
74
Stolen UpdraftCentral keys used to install malicious WordPress plugins
TeamUpdraft says its site was accessed October 17–18 and the database held UpdraftCentral, Vault, and Clone keys.
78
Rank Math PRO downloads carried a self-restoring backdoor for about 11 hours
Copies fetched from rankmath.com between October 15 20:02 UTC and October 16 07:12 UTC can recreate a hidden backdoor; clean release is 3.0.124.
78
PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Some Rank Math SEO PRO 3.0.123 downloads included malware that can backdoor WordPress sites and steal credentials.
80
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
58
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
Backuply through version 1.5.8 lets subscribers plant SQL that becomes administrator access on restore.
64
Ghostscript flaw lets hackers hijack servers via PDF uploads
Ghostscript heap overflow CVE-2026-39919 can enable remote code execution through crafted PDF uploads, with no exploitation seen yet.
68
Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server
Wordfence disclosed Ghostscript CVE-2026-39919, a CVSS 9.8 flaw fixed in 10.08.0, with lab PDF remote code execution.
68
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Attackers actively exploit CVSS 10.0 flaw CVE-2026-85097 in Bricksforge WordPress plugin for unauthenticated RCE.
82
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026)
Wordfence’s weekly report lists new WordPress vulnerabilities, but this excerpt names none.
18
Cybersecurity Imperatives Will Demand AI Math
Wordfence argues cybersecurity needs AI-driven math before public-key encryption fails.
22
Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers
Fortbridge showed authenticated WordPress HEIC uploads can exploit libheif and execute code in PHP-FPM.
64
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Wordfence published its weekly WordPress vulnerability report for disclosures made September 21–27, 2026.
24
Quarterly WordPress Threat Intelligence Report – Q2 2026
Wordfence publishes its Q2 2026 WordPress threat intelligence report summarizing vulnerabilities, attacks, and mitigation trends.
28
Wordfence Bug Bounty Program Monthly Report – June 2026
Wordfence's June 2026 bug bounty report logged 1,066 WordPress vulnerability submissions.
18
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Wordfence published its weekly WordPress vulnerability report for September 14–20, 2026.
18
WordPress Malware Uses Hidden Plugin and Blockchain C2 to Stay Undetected
Wordfence found WordPress malware that hides as a must-use plugin and uses Ethereum EtherHiding for command and control.
68
Stealthy WordPress Malware Uses Must-Use Plugin and Ethereum EtherHiding for Persistent Backdoor Access
Wordfence details a WordPress must-use plugin backdoor that steals credentials and hides C2 on Ethereum.
60
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
WordPress patched a critical unauthenticated path traversal that can enable PHP inclusion and RCE.
78
Inside a Malicious, Stealthy WordPress Must Use Plugin
Wordfence analyzed WordPress malware installed as a must-use plugin that self-heals to survive removal.
48
Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution
A CVSS 8.8 PHP object injection flaw (CVE-2026-78175) in Tutor LMS exposes 100,000+ WordPress sites to subscriber-level remote code execution; patched in 4.0.8.
60
Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability
Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.
68
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.
60
WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review
WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.
58
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Wordfence's weekly WordPress vulnerability report summarizes plugin and theme vulnerabilities disclosed and added to its database during the week ending September 6, 2026.
12
WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites
WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.
52
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.
80
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.
60
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- Supply-chain malware in some Rank Math SEO PRO 3.0.123 packages
- Heap Buffer Overflow in Ghostscript JPEG 2000 Output Path Enables RCE
- PHP Object Injection to RCE in Tutor LMS WordPress Plugin (≤ 4.0.7)
- CVE-2026-148943%9.8The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the…
- CVE-2026-324752%9.0Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
- CVE-2026-275403%9.0Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd
- Unauthenticated RCE in WordPress Core during upgrades
- Unauthenticated Stored XSS in WPC Product Bundles for WooCommerce
Appears with
- WordPressproduct · 24
- Wordfencevendor · 14
- WordPressvendor · 12
- WordPressorganization · 3
- Rank Mathvendor · 3
- PHPproduct · 3
- ImageMagickproduct · 3
- Patchstackorganization · 3
- Rank Math PROproduct · 2
- PHPvendor · 2
- UpdraftPlusproduct · 2
- Nethembaorganization · 2
- Patchstackvendor · 2
- Defiantorganization · 2
- Artifexorganization · 2
- Tutor LMSproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.