Cybersecurity Threats: Over 240,000 Attacks Target WordPress Core Vulnerability
In a concerning development for the WordPress community, researchers have identified that attackers have initiated more than 240,000 exploit attempts targeting a notable vulnerability in the WordPress Core upgrade process. This flaw can permit unauthenticated remote code execution, posing significant risks to users and website administrators alike.
The alarming report was brought to light by Wordfence researcher István Márton, who noted that these cyberattacks began on October 28, 2026. The vulnerability, classified as CVE-2026-119977, is regarded as high severity with a CVSS score of 8.1. It primarily affects unpatched versions of WordPress ranging from 4.7 to 7.1.3.
Understanding the Vulnerability
The core of this vulnerability lies in the staged-installer remote code execution. It enables attackers to access temporary installation files during an ongoing upgrade. The underlying cause is identified as a time-of-check/time-of-use race condition. This technical flaw occurs within predictable and web-accessible staging directories, which are established during full-package Core upgrades.
Specifically, these directories exist under the path /wp-content/upgrade/. An unauthenticated attacker who gains access to these staged installer files prior to cleanup can perform a separate installation, create an administrator account, and upload malicious PHP scripts, leading to potentially devastating consequences for the affected sites.
Mitigation Through Updates
In response to the escalating threat, WordPress released version 7.1.4, which incorporates various security enhancements including staging-directory randomization, an index guard, and restrictions on unsafe promotion of staged configuration data. These measures are aimed at significantly reducing opportunities for attackers to exploit the installer process.
Cybersecurity experts noted that observed requests were specifically targeting paths like /wp-content/upgrade/wordpress-6.9.11/setup-config.php in an attempt to intercept sites while the installer files were still accessible. If successful, such exploitation could result in server-side execution, paving the way for backdoors, unauthorized content modifications, and even theft of sensitive data.
Analyzing Request Patterns
Data provided by Wordfence indicates that the heaviest probing activity occurred between October 29 and November 1, with over 74,000 requests blocked on October 30 alone. Among the entities responsible for the attempts, an IP address, 103.59.160.171, accounted for more than 74,900 requests, followed by 2001:df1:e8c0::106b with over 40,400 requests, and 51.89.103.78, which exceeded 34,600 requests. It is essential to highlight that these figures represent blocked attempts and do not necessarily indicate successful compromises.
Despite the high volume of requests, automated probing is complicated by the brief nature of the upgrade window, making successful exploitation significantly more challenging than the sheer numbers might suggest.
Recommendations for Administrators
In light of these developments, WordPress site administrators are urged to take precautionary measures, including inspecting access logs for any external requests targeting PHP files under /wp-content/upgrade/, especially setup-config.php. Typically, legitimate upgrade processes do not necessitate public access to these staged scripts, according to the advisory issued by Wordfence.
Additionally, administrators should thoroughly examine leftover staging directories, unexpected plugins, unfamiliar administrator accounts, and the possibility of backdoors. While suspicious requests warrant further investigation, it is crucial to remember that they do not necessarily confirm successful code execution. Likewise, the absence of log entries cannot definitively rule out compromises.
To safeguard their sites, administrators are strongly advised to upgrade to WordPress 7.1.4 or any corresponding patched release as soon as possible. Notably, upgrading from an affected version invokes the existing upgrade logic, prompting administrators to first block web access to PHP files under /wp-content/upgrade/ to thwart potential exploits.
Furthermore, Wordfence protection requires an optimized firewall operating in Extended Protection mode, as standalone staged scripts do not load WordPress. Premium protection was made available on October 28, while free-tier coverage is slated for November 27.
The urgency for heightened awareness and proactive security measures cannot be overstated, considering the escalating frequency of cyber threats targeting popular platforms like WordPress. Admins are encouraged to remain vigilant and promptly adapt to mitigate potential vulnerabilities as the digital landscape continues to evolve.