Hackers Target Vulnerability in WordPress Core Amidst Software Update Window
Recent reports indicate that hackers are actively trying to exploit a remote code execution vulnerability in WordPress Core, identified as CVE-2026-119977. This vulnerability presents an opportunity for attackers to gain unauthorized access during a brief exposure window that occurs while WordPress is undergoing software updates.
A record published by cybersecurity firm Wordfence indicates a staggering number of 58,693 blocked attacks within a mere 24-hour period. While this figure suggests a formidable level of attempted exploitation, it is essential to note that these attacks do not equate to successful breaches, highlighting the critical need for effective defenses during periods of vulnerability.
On October 28, 2026, WordPress took decisive action by releasing version 7.1.4, which specifically addresses 22 distinct security vulnerabilities, including the aforementioned CVE-2026-119977. The significance of this vulnerability lies in its ability to be exploited without requiring an authenticated user account or direct user interaction. However, several specific environmental and timing conditions must be met for an attacker to successfully carry out their plans.
Rated with a CVSS score of 8.1, the vulnerability affects WordPress versions ranging from 4.7 to 7.1.3. The high complexity of the attack is reflective of stringent timing requirements, which could deter some attackers, although the potential consequences of a successful breach could be severe.
Vulnerable installations typically extract essential files into predictable directories located beneath the wp-content/upgrade folder during full-package Core upgrades. These temporary directories remain exposed to the public as the upgrade process unfolds. If an unauthenticated attacker can access the setup-config.php file before it is cleaned up, they may interact with the temporary installation and execute PHP code, thereby compromising the website.
To exploit this vulnerability, attackers must have access to installer files and a publicly reachable staging path, along with the capacity for PHP code execution within that directory hierarchy. Time is also a critical factor; laboratory observations suggest that the window of opportunity for attackers lasts only a few seconds. To navigate this challenge, hackers utilize repeated polling techniques to attempt to reach vulnerable installer paths precisely at the time when updates expose them.
Wordfence documented its first match of a firewall rule only nine minutes after the deployment of WordPress 7.1.4, while over 18,500 requests targeting the exposed installer paths were recorded in just the first 21 hours. It was reported that two major groups spent approximately 14.5 hours polling small clusters of websites in an attempt to exploit this vulnerability.
In response to this critical issue, the security fix introduced randomization of staging directories, implemented an index guard, and prevented unsafe promotion of staged configuration data. Additionally, security patches have been backported to earlier affected branches, although the WordPress team notes that only its latest release is currently supported.
Wordfence subsequently deployed its firewall rule strategically on October 28 at 20:30 UTC to protect its Premium, Care, and Response customers, while free-tier users are scheduled to receive access to this security measure on November 27, adhering to the standard 30-day delay.
Extended protection remains vital in this context, as exploit requests can access exposed PHP files without needing to first load WordPress. Therefore, it is imperative for administrators to verify the optimization of their firewalls rather than assuming that mere receipt of the firewall rule assures adequate coverage. Importantly, firewall filtering should not be considered a substitute for necessary patching.
For site owners, it is crucial to navigate to the Dashboard and select Update, ensuring they install WordPress version 7.1.4 or an equivalent patched release. Additionally, logs should be scrutinized for any unexpected requests under the wp-content/upgrade directory, and any unfamiliar administrator accounts, unauthorized plugins, or suspicious PHP files must be thoroughly investigated.
While updating the system effectively removes the vulnerable behavior, complementary measures such as scanning and firewall controls are essential for comprehensive remediation. However, it is crucial to recognize that neither a successful update nor statistics about blocked attacks guarantee that a server previously exposed to the vulnerability has evaded compromise. Any suspicious findings merit further investigation and incident response to ensure that websites remain secure against evolving threats.
In conclusion, ongoing vigilance and proactive measures are essential for website administrators as they navigate the complexities of cybersecurity in an ever-evolving threat landscape. Joining communities, such as those comprised of more than 16,000 security operations center (SOC) teams using advanced tools like ANY.RUN, can further streamline threat investigations and reduce manual efforts in combating these persistent challenges.