Hackers are actively targeting a critical vulnerability in WordPress Core, with over 240,000 exploit attempts reported. This flaw allows unauthorized code execution, posing significant risks to affected sites. Identified as CVE-2026-119977, the issue was disclosed alongside a WordPress security update released on October 28, 2026.
Understanding the Vulnerability
The vulnerability affects WordPress versions from 4.7 up to 7.1.3, with a severity score of 8.1 on the CVSS scale. Discovered by researcher Umut Bayram, the flaw involves predictable folder names created during WordPress Core upgrades. Attackers can locate these folders through web requests, exploiting the vulnerability without needing to log in.
WordPress’s update on October 28 addressed this and other security issues, providing backported patches for older versions. These changes aim to mitigate risks during upgrades by altering how temporary folders are handled.
Details of the Exploit Attempts
During WordPress upgrades, installation files are extracted into temporary folders under /wp-content/upgrade/. The risk arises from predictable folder names, which attackers can exploit to find separate installers while updates are in progress. The attack relies on a race condition, requiring precise timing to access files before cleanup.
The Wordfence report indicates that the attack traffic peaked on October 30, with its firewall blocking over 74,000 requests. While these numbers highlight intense attack activity, they do not confirm successful breaches. The attempts were highest between October 29 and November 1.
Preventive Measures and Recommendations
Website administrators should ensure they are running WordPress version 7.1.4 or a patched version for their branch. Although automatic updates may have addressed the issue, manual verification is recommended. WordPress advises prompt updates, as only the latest release receives support.
Updating from a vulnerable version still involves using the current upgrade process once. Wordfence suggests blocking public access to PHP files in /wp-content/upgrade/ prior to updates, using Extended Protection mode to safeguard against staged PHP file execution.
For increased security, administrators should monitor for indicators of compromise, such as suspicious IP addresses and paths, to prevent potential intrusions.
The continued vigilance and timely application of security patches are essential for maintaining WordPress site integrity and protecting against sophisticated cyber threats.
