WordPress Core RCE Vulnerability Allows Unauthenticated Remote Code Execution
Original title: Hackers Exploit WordPress Core RCE Vulnerability in Over 240,000 Attack Attempts
Attackers exploit race condition in WordPress Core upgrades for unauthenticated RCE on versions 4.7 to 7.1.3.
Attackers launched over 240000 exploit attempts against a WordPress Core upgrade flaw that can enable unauthenticated remote code execution. The flaw affects unpatched branches from 4.7 through 7.1.3. WordPress 7.1.4 fixes the issue with staging directory randomization.
Unconfirmed: Blocked attempts do not confirm successful exploitation
- Tracked as CVE-2026-119977 with CVSS score of 8.1
- Requires reaching temporary staging files during active upgrade
- WordPress 7.1.4 randomizes directories and adds index guard
- Heaviest activity between October 29 and November 1
- 1.Install WordPress 7.1.4 immediately
- 2.Block web access to PHP files under /wp-content/upgrade/
- 3.Inspect access logs for external requests to setup-config.php
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | 1% | KEVPoC ×7 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.59.160.171 | 00 blocked requests on October 30. Leading sources included 103.59.160.171, responsible for over 74,900 requests; 2001:df1:e8c0::106b, |
| ipv4 | 51.89.103.78 | 74,900 requests; 2001:df1:e8c0::106b, exceeding 40,400; and 51.89.103.78, exceeding 34,600. These figures represent blocked attempts |
From the original article
2 min read at gbhackers.com
Attackers have launched more than 240,000 exploit attempts against a WordPress Core upgrade-process flaw that can enable unauthenticated remote code execution. Wordfence researcher István Márton reported that targeting began on October 28, 2026. Tracked as CVE-2026-119977, the high-severity issue carries a CVSS score of 8.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.