WordPress core upgrade race condition draws mass exploit attempts
First merged summary.
Attackers are probing CVE-2026-119977 in WordPress 4.7–7.1.3; patches exist, but sites can stay exposed while updating.
Wordfence recorded more than 240,000 blocked exploit attempts against CVE-2026-119977, a WordPress Core race condition that can allow unauthenticated remote code execution during a full upgrade. The flaw affects unpatched branches 4.7 through 7.1.3 and is fixed in 7.1.4 and matching backports. Cyber Security News says the counts are blocked requests, not confirmed infections, and that success is difficult because of the timing window. The Hacker News reports active exploitation, including a CISA KEV listing, and says installing the fix can still use old code and leave a last exposure window. WordPress 7.1.4 randomizes staging directories and adds an index guard.
- CVE-2026-119977 has a CVSS score of 8.1.
- Affected versions are WordPress 4.7 through 7.1.3.
- Fixed in 7.1.4 and backported branch updates to 4.7.
- Wordfence blocked over 240,000 attempts, peaking above 74,000 on October 30.
- Traffic began October 28, 2026, the day WordPress patched the flaw.
- CISA added the flaw to the KEV catalog, according to The Hacker News.
Timeline
dated events in the reporting · oldest first- Oct 28, 2026WordPress patched the flaw as exploit traffic began. · Cyber Security News
- Oct 30, 2026Blocked requests peaked at more than 74,000. · Cyber Security News
What each outlet adds
beyond the shared facts- Cyber Security NewsBlocked-request counts, peak day, and difficult timing window.
- The Hacker NewsKEV listing and residual exposure while installing the fix.
- GBHackers7.1.4 staging randomization and index guard.
- CVEs
- CVE-2026-119977
- Products
- WordPress Core
- Organizations
- Wordfence
Coverage
oldest first · one row per article · UTC- · 6d ago
Cyber Security NewsFirst report
WordPress core flaw draws 240,000 exploit attempts (CVE-2026-119977)
Wordfence blocked the probes; counts are requests, not confirmed infections or sites compromised.
- · 6d ago
The Hacker News
WordPress update race exposes sites to exploited CVE-2026-119977
WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.
- · 5d ago
GBHackers
WordPress Core RCE Vulnerability Allows Unauthenticated Remote Code Execution
Attackers exploit race condition in WordPress Core upgrades for unauthenticated RCE on versions 4.7 to 7.1.3.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | 1% | KEVPoC ×7 | KEV |