WordPress core flaw draws 240,000 exploit attempts (CVE-2026-119977)
Original title: Hackers Launch 240,000 Exploit Attempts WordPress Core Flaw Enabling Remote Code Execution
Wordfence blocked the probes; counts are requests, not confirmed infections or sites compromised.
Attackers sent more than 240,000 exploit attempts at CVE-2026-119977, a WordPress Core race condition that can allow unauthenticated remote code execution during a full upgrade. Wordfence says traffic began on October 28, 2026, the day WordPress patched the flaw, and peaked on October 30 with more than 74,000 blocked requests. Predictable folders under /wp-content/upgrade/ can expose a temporary installer. Successful exploitation is described as difficult because of the timing window.
Unconfirmed: Blocked-request totals do not confirm successful code execution or how many sites were compromised.
- CVSS score is 8.1; unpatched branches 4.7 through 7.1.3 are affected.
- WordPress 7.1.4 and backported branch patches address the issue.
- Activity was highest between October 29 and November 1.
- An exposed installer could create an admin account and upload PHP.
- Wordfence lists multiple attacking IP addresses and setup-config.php paths.
Impact: Unauthenticated remote code execution during a core upgrade
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | unpatched branches from 4.7 through 7.1.3 | 7.1.4 or the corresponding patched release for the branch |
- 1.Install WordPress 7.1.4 or the patched release for the installed branch.
- 2.Verify that automatic background updates actually completed.
- 3.Block public access to PHP files under /wp-content/upgrade/ before updating.
- CVEs
- CVE-2026-119977
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | 1% | KEVPoC ×7 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.59.160.171 | WordPress loading. Indicators of Compromise Indicator Type 103.59.160[.]171 IPv4 address 2001:df1:e8c0[::]106b IPv6 address 51.89.103 |
| ipv4 | 154.26.238.8 | ss 20.217.186[.]29 IPv4 address 87.58.197[.]83 IPv4 address 154.26.238[.]8 IPv4 address 20.46.43[.]126 IPv4 address /wp-content/upgr |
| ipv4 | 185.177.72.61 | 1:df1:e8c0[::]106b IPv6 address 51.89.103[.]78 IPv4 address 185.177.72[.]61 IPv4 address 195.3.220[.]7 IPv4 address 96.62.218[.]148 I |
| ipv4 | 195.3.220.7 | ss 51.89.103[.]78 IPv4 address 185.177.72[.]61 IPv4 address 195.3.220[.]7 IPv4 address 96.62.218[.]148 IPv4 address 20.217.186[.]29 |
| ipv4 | 20.217.186.29 | ess 195.3.220[.]7 IPv4 address 96.62.218[.]148 IPv4 address 20.217.186[.]29 IPv4 address 87.58.197[.]83 IPv4 address 154.26.238[.]8 I |
| ipv4 | 20.46.43.126 | ess 87.58.197[.]83 IPv4 address 154.26.238[.]8 IPv4 address 20.46.43[.]126 IPv4 address /wp-content/upgrade/ URL path setup-config.p |
| ipv4 | 51.89.103.78 | 9.160[.]171 IPv4 address 2001:df1:e8c0[::]106b IPv6 address 51.89.103[.]78 IPv4 address 185.177.72[.]61 IPv4 address 195.3.220[.]7 I |
| ipv4 | 87.58.197.83 | s 96.62.218[.]148 IPv4 address 20.217.186[.]29 IPv4 address 87.58.197[.]83 IPv4 address 154.26.238[.]8 IPv4 address 20.46.43[.]126 I |
| ipv4 | 96.62.218.148 | ess 185.177.72[.]61 IPv4 address 195.3.220[.]7 IPv4 address 96.62.218[.]148 IPv4 address 20.217.186[.]29 IPv4 address 87.58.197[.]83 |
From the original article
3 min read at cybersecuritynews.com
Hackers have launched more than 240,000 exploit attempts against a WordPress Core vulnerability that can allow attackers to run malicious code without logging in. According to the supplied Wordfence report, attacks began on October 28, 2026, the same day WordPress released a security update addressing the flaw. Tracked as CVE-2026-119977, the vulnerability carries a high […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.