Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

Attackers probe patched WordPress core upgrade-window RCE

4 sources · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Wordfence has blocked more than 240,000 probes of CVE-2026-119977, a WordPress upgrade race condition that CISA lists as exploited.

WordPress 7.1.4 and branch backports, released October 28, 2026, fix CVE-2026-119977, an unauthenticated remote code execution race condition in core versions 4.7 through 7.1.3. It is exploitable only during a full-package upgrade, through predictable paths under /wp-content/upgrade/. Wordfence says probing began that day and its firewall has blocked more than 240,000 attempts, peaking October 30 above 74,000 blocked requests; Cyber Security News says those figures are requests, not confirmed compromises. CISA added the flaw to the Known Exploited Vulnerabilities catalog on November 2. Installing the fix can still unpack files with old code, so that one update remains a brief exposure window.

Key facts
  • CVE-2026-119977, CVSS 8.1, affects WordPress 4.7 through 7.1.3.
  • Fixed in 7.1.4 and backports including 6.9.11 and 7.0.8.
  • Wordfence blocked over 240,000 attempts; October 30 peak exceeded 74,000.
  • Heaviest activity ran from October 29 through November 1.
  • Free Wordfence firewall rule is scheduled for November 27, 2026.
  • Version 7.1.4 randomizes staging directories and adds an index guard.
Analyze CVE-2026-119977 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026WordPress released 7.1.4 and branch patches. · Wordfence
  2. Oct 29, 2026Heaviest probing began and continued through November 1. · Cyber Security News
  3. Oct 30, 2026Blocked requests peaked above 74,000. · Cyber Security News
  4. Nov 2, 2026CISA added CVE-2026-119977 to the KEV catalog. · Wordfence

What each outlet adds

beyond the shared facts
  • WordfenceBranch patch versions, delayed free rule, and upgrade-folder PHP blocking.
  • Cyber Security NewsPeak day and that counts are requests, not confirmed infections.
  • The Hacker NewsThe patch install itself still unpacks files with old code.
  • GBHackers7.1.4 randomizes staging directories and adds an index guard.
CVEs
CVE-2026-119977
Vendors
WordPressWordfence
Products
WordPress CoreWordfence
Organizations
WordfenceCISA

Coverage

oldest first · one row per article · UTC
  1. · 6d ago WordfenceFirst report

    Attackers probe WordPress upgrade-window RCE, CVE-2026-119977

    Wordfence blocked over 240,000 attempts; CISA added the flaw to KEV on November 2.

  2. · 5d ago Cyber Security News

    WordPress core flaw draws 240,000 exploit attempts (CVE-2026-119977)

    Wordfence blocked the probes; counts are requests, not confirmed infections or sites compromised.

  3. · 5d ago The Hacker News

    WordPress update race exposes sites to exploited CVE-2026-119977

    WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.

  4. · 4d ago GBHackers

    WordPress Core RCE Vulnerability Allows Unauthenticated Remote Code Execution

    Attackers exploit race condition in WordPress Core upgrades for unauthenticated RCE on versions 4.7 to 7.1.3.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-119977
Unauthenticated RCE in WordPress Core during upgrades
8.11%KEVPoC ×7
KEV