WordPress core RCE under active attack; Wordfence blocks 58,693 attempts
Original title: WordPress RCE Vulnerability Under Active Attack With Over 58,000 Exploit Attempts Blocked
CVE-2026-119977 in WordPress 4.7 through 7.1.3 can yield unauthenticated PHP execution during brief upgrades; 7.1.4 patches it.
Attackers are probing an unauthenticated remote code execution flaw in WordPress Core that is exposed only while a full-package upgrade stages installer files under wp-content/upgrade. Wordfence reports 58,693 blocked attempts in 24 hours, not confirmed compromises. WordPress 7.1.4, released October 28, 2026, fixes the issue among 22 vulnerabilities and backports fixes to older branches.
Unconfirmed: The 58,693 figure counts blocked attempts, not confirmed successful compromises.
- CVE-2026-119977 has a CVSS score of 8.1 and high attack complexity.
- Laboratory observations suggest the staging window lasts only seconds.
- Wordfence saw its first rule match nine minutes after deployment.
- More than 18,500 requests hit staged installer paths in the first 21 hours.
- Free Wordfence users receive the rule on November 27, after a 30-day delay.
Impact: Unauthenticated PHP code execution during core upgrades
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | 4.7 through 7.1.3 | 7.1.4 and corresponding patched branch releases |
- 1.Install WordPress 7.1.4 or the matching patched branch release.
- 2.Verify Wordfence Extended Protection rather than assuming the rule alone covers staged PHP.
- 3.Inspect logs for requests under wp-content/upgrade and review unknown admins, plugins, and PHP files.
- CVEs
- CVE-2026-119977
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | — |
From the original article
2 min read at gbhackers.com
Hackers are attempting to exploit an unauthenticated remote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates. The supplied Wordfence record reports 58,693 blocked attacks within 24 hours, representing nearly 60,000 attempts rather than confirmed successful compromises. WordPress released version 7.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.