Exploit / PoChighExploited in the wild

Attackers probe WordPress upgrade-window RCE, CVE-2026-119977

Original title: Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core

Wordfenceby István MártonNov 5, 2026 · 15:52 UTC (5d ago)12 min read1

Part of a story covered by 10 sourcesCISA lists exploited WordPress upgrade race CVE-2026-119977Merged summary & timeline

AI summary · x-ai/grok-4.7Summaries by Vani AI

Wordfence blocked over 240,000 attempts; CISA added the flaw to KEV on November 2.

WordPress 7.1.4 and backports, released October 28, 2026, fix an unauthenticated remote code execution flaw in core versions 4.7 through 7.1.3. CVE-2026-119977 is a race condition exploitable only while a full-package core upgrade is running, via predictable web-accessible staging paths. Wordfence says attackers began targeting it the day it was disclosed and its firewall has blocked over 240,000 attempts. CISA added it to the Known Exploited Vulnerabilities catalog on November 2, 2026.

Unconfirmed: Wordfence says successful remote code execution is difficult in practice because the race window is short.

Key facts

CVSS rating given by Wordfence is 8.1 High.
Patched releases include 7.1.4 and branch fixes such as 6.9.11 and 7.0.8.
Free Wordfence users get the firewall rule on November 27, 2026.
Updating still runs the vulnerable upgrade process once, for the length of the update.
Site owners can block PHP files in /wp-content/upgrade/ before updating.

Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated remote code execution during a core upgrade

Product	Affected	Fixed in
WordPress Core	4.7 through 7.1.3	4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

1.Update to WordPress 7.1.4 or the patched security release for the installed branch.
2.Block web access to PHP files in /wp-content/upgrade/ before updating.
3.Use a Wordfence firewall rule; paid plans received it on October 28, 2026.

Analyze CVE-2026-119977 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2026-119977

ATT&CK: T1190 Exploit Public-Facing Application

Tags: wordpress rce kev race-condition wordfence

Vendors: WordPress
Products: WordPress Core Wordfence
Organizations: CISA

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-119977	Unauthenticated RCE in WordPress Core during upgrades	8.1	1%	KEVPoC ×7	10d ago KEV Nov 3, 2026

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
email	privacy@defiant.com	. Close Questions? Contact our Privacy Team at: • Email:privacy@defiant.com • Mail: Defiant Inc. Attn: Privacy Issues, 1700 Westlake Av
ipv4	103.59.160.171	ively engaged IP addresses targeting this vulnerability: • 103.59.160.171 • Over 74,900 blocked requests. • 2001:df1:e8c0::106b •
ipv4	154.26.238.8	equests. • 87.58.197.83 • Over 2,000 blocked requests. • 154.26.238.8 • Over 1,800 blocked requests. • 20.46.43.126 • Over 1,7
ipv4	185.177.72.61	quests. • 51.89.103.78 • Over 34,600 blocked requests. • 185.177.72.61 • Over 4,400 blocked requests. • 195.3.220.7 • Over 2,90
ipv4	195.3.220.7	quests. • 185.177.72.61 • Over 4,400 blocked requests. • 195.3.220.7 • Over 2,900 blocked requests. • 96.62.218.148 • Over 2,
ipv4	20.217.186.29	quests. • 96.62.218.148 • Over 2,300 blocked requests. • 20.217.186.29 • Over 2,000 blocked requests. • 87.58.197.83 • Over 2,0
ipv4	20.46.43.126	equests. • 154.26.238.8 • Over 1,800 blocked requests. • 20.46.43.126 • Over 1,700 blocked requests. [](https://www.wordfence.c
ipv4	51.89.103.78	• 2001:df1:e8c0::106b • Over 40,400 blocked requests. • 51.89.103.78 • Over 34,600 blocked requests. • 185.177.72.61 • Over 4
ipv4	87.58.197.83	quests. • 20.217.186.29 • Over 2,000 blocked requests. • 87.58.197.83 • Over 2,000 blocked requests. • 154.26.238.8 • Over 1,8
ipv4	96.62.218.148	requests. • 195.3.220.7 • Over 2,900 blocked requests. • 96.62.218.148 • Over 2,300 blocked requests. • 20.217.186.29 • Over 2,

From the original article

12 min read at wordfence.com

On October 28th, 2026, the WordPress Security Team released WordPress 7. 1. 4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977.

Wordfence

By István Márton · wordfence.com

Read the full article at Wordfence

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.