INCIDENT REPORT #002
WordPress Core Under Active Attack: Upgrade Vulnerability CVE-2026-119977
Attackers have targeted a WordPress core vulnerability that can permit unauthenticated remote code execution during software upgrades. Wordfence reported more than 240,000 blocked exploitation attempts by 5 November 2026, and CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. WordPress 7.1.4 and corresponding security releases address the flaw. Website owners should verify their patch status and investigate suspicious upgrade activity.
01 / OVERVIEW
Overview
Attackers have targeted a WordPress core vulnerability that can permit unauthenticated remote code execution during software upgrades. Wordfence reported more than 240,000 blocked exploitation attempts by 5 November 2026, and CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. WordPress 7.1.4 and corresponding security releases address the flaw. Website owners should verify their patch status and investigate suspicious upgrade activity.
- ENVIRONMENT
- Self-hosted WordPress installations running vulnerable core releases from 4.7.0 through 7.1.3, where temporary upgrade files are accessible over HTTP.
- INCIDENT CLASS
- EXPLOITATION OBSERVED / WORDPRESS CORE REMOTE CODE EXECUTION
- PROVENANCE
- PUBLIC-SOURCE TECHNICAL ANALYSIS
02 / SITUATION
Situation
On 28 October 2026, the WordPress Security Team released WordPress 7.1.4, addressing several security vulnerabilities, including an unauthenticated remote code execution weakness in the WordPress core upgrade process.
The vulnerability, tracked as CVE-2026-119977, affects unpatched WordPress releases across branches 4.7 through 7.1.
Unlike conventional vulnerabilities affecting plugins, themes or exposed application endpoints, this weakness exists within the mechanism WordPress uses to install core updates.
During certain WordPress core upgrades, software packages are extracted into temporary directories beneath wp-content/upgrade/.
In affected versions, these temporary directories can have predictable names and may be accessible through the website's public web server.
An attacker who reaches the exposed installation components during the brief upgrade window may be able to execute unauthorised code within the hosting environment.
Successful exploitation could allow an attacker to compromise the WordPress installation, introduce malicious software or establish persistent unauthorised access.
The vulnerability does not require an existing WordPress account.
However, exploitation requires precise timing while a vulnerable core upgrade is in progress, making successful exploitation difficult under ordinary conditions.
SECURITY RESEARCH FINDINGS
Wordfence confirmed that attackers began targeting the vulnerability on 28 October 2026, the same day it was publicly disclosed.
In research published on 5 November 2026, Wordfence reported that its firewall had blocked more than 240,000 exploitation attempts targeting the weakness.
The highest recorded activity occurred between 29 October and 1 November 2026, with more than 74,000 blocked attempts on 30 October alone.
On 3 November 2026, the United States Cybersecurity and Infrastructure Security Agency added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
This establishes the incident as more than a theoretical security disclosure.
Nevertheless, the number of blocked attempts must not be interpreted as the number of successfully compromised websites.
The publicly reviewed research does not establish how many WordPress installations were successfully compromised.
This report documents confirmed exploitation activity and its technical implications. It does not describe an incident personally investigated or remediated by SecureMyWP.
03 / WHAT WE FOUND
Findings
VULNERABILITY IDENTIFICATION
Affected software: WordPress Core
CVE identifier: CVE-2026-119977
Vulnerability category: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE classification: CWE-367
Attack class: Unauthenticated Remote Code Execution
Wordfence CVSS v3.1 score: 8.1 - High
Patchstack CVSS score: 9.0 - Critical
Security Research classification: Exploitation Observed
Disclosure date: 28 October 2026
Affected versions: Unpatched WordPress core releases from 4.7.0 through 7.1.3.
Primary remediation: WordPress 7.1.4 or the corresponding patched release for an older branch.
The vulnerability was reported by security researcher Umut Bayram.
TECHNICAL ROOT CAUSE
The weakness originates from the way affected versions of WordPress prepare temporary installation files during full-package core upgrades.
Before the security fix, WordPress could extract a complete software package into a predictably named directory beneath:
wp-content/upgrade/
This temporary installation contained WordPress components that could be executed independently of the website's existing configuration.
Because the staging directory could be accessible through the public web server, an unauthenticated visitor might reach these components while the upgrade was running.
In particular, the exposed WordPress installation configuration component could permit unauthorised installation activity within the temporary environment.
Successful abuse could allow attacker-controlled PHP execution within the privileges available to the web server process.
The security weakness therefore depended on the interaction between predictable temporary directory names, public web accessibility and the timing of the core update process.
WordPress 7.1.4 addressed the vulnerability by modifying the staging-directory handling and related upgrade protections.
EXPLOITATION PREREQUISITES
Several conditions must exist for exploitation to succeed.
The website must be running a vulnerable WordPress core version.
The hosting environment must permit HTTP access to the relevant temporary upgrade files.
A core upgrade must be in progress.
The attacker must reach the exposed installation component during the short period before the temporary files are removed.
The attacker must then complete the necessary malicious activity before the available window closes.
These requirements significantly increase exploitation difficulty.
Nevertheless, attackers can automate repeated requests against potentially vulnerable websites.
Consequently, a vulnerability with a narrow exploitation window can still attract substantial automated attack activity.
OBSERVED ATTACK ACTIVITY
According to Wordfence's research published on 5 November 2026:
More than 240,000 exploitation attempts had been blocked.
The first observed attempts occurred on 28 October 2026.
The highest activity occurred between 29 October and 1 November 2026.
More than 74,000 attempts were blocked on 30 October.
The observed requests targeted installation files in predictable temporary WordPress upgrade directories.
These figures represent blocked malicious requests recorded by Wordfence, not independently confirmed successful compromises.
CISA's inclusion of CVE-2026-119977 in its Known Exploited Vulnerabilities catalog provides additional authoritative evidence supporting the exploitation classification.
INDICATORS OF SUSPICIOUS ACTIVITY
Website administrators and incident responders should investigate unexpected external HTTP requests involving:
/wp-content/upgrade/
Particular attention should be given to requests targeting:
setup-config.php
within temporary WordPress upgrade directories.
Wordfence identified the following IP addresses among the most active sources of suspicious requests in its November 2026 research:
103.59.160.171
2001:df1:e8c0::106b
51.89.103.78
Additional indicators include:
Repeated requests to temporary core installation directories.
Suspicious requests occurring during a WordPress core update.
Unexpected HTTP responses indicating that installation components were publicly accessible.
Unauthorised WordPress administrator accounts.
Unknown plugins or themes appearing after an update.
Unrecognised PHP files or web shells.
Unexpected changes to WordPress configuration files.
Suspicious outbound connections initiated by the hosting environment.
Unexpected file modifications around the time of a core upgrade.
These indicators should be investigated in context.
An IP address appearing in historical threat intelligence is not, by itself, proof of compromise.
Likewise, a suspicious HTTP request does not establish that code execution succeeded.
POTENTIAL IMPACT
Successful exploitation may allow an attacker to execute PHP code with the permissions assigned to the web server process.
Depending on the hosting configuration, this could enable:
Unauthorised manipulation of website files.
Creation of malicious administrator accounts.
Installation of web shells or backdoors.
Modification of website content.
Injection of malicious redirects or SEO spam.
Theft of sensitive application data.
Exposure of accessible credentials and configuration secrets.
Installation of malicious plugins.
Persistence beyond the original exploitation event.
The ultimate impact depends on the privileges available to the compromised process and the security controls implemented by the hosting provider.
These consequences describe potential attacker capabilities, not confirmed outcomes for every targeted website.
PATCH STATUS
WordPress released version 7.1.4 on 28 October 2026.
Corresponding security fixes were also backported to older WordPress branches.
Relevant fixed releases include:
WordPress 7.1: 7.1.4
WordPress 7.0: 7.0.8
WordPress 6.9: 6.9.11
WordPress 6.8: 6.8.12
WordPress 6.7: 6.7.11
WordPress 6.6: 6.6.11
WordPress 6.5: 6.5.14
WordPress 6.4: 6.4.14
WordPress 6.3: 6.3.14
WordPress 6.2: 6.2.15
WordPress 6.1: 6.1.16
WordPress 6.0: 6.0.18
Additional patched releases exist for older branches.
Website owners should use the latest supported WordPress release wherever practical.
Applying a security fix to a legacy branch should not be considered a substitute for maintaining a supported and regularly updated software environment.
IMPORTANT UPDATE CONSIDERATION
The vulnerability exists in the upgrade mechanism of the version already installed on the website.
Consequently, upgrading from an affected WordPress release to a patched release may use the vulnerable upgrade mechanism one final time.
This does not mean administrators should postpone security updates.
Wordfence recommends updating promptly while implementing additional precautions where possible.
Restricting public web access to the temporary upgrade directory before applying the update can reduce exposure during this final vulnerable upgrade window.
After the patched WordPress version is installed, subsequent core upgrades are no longer affected by this specific weakness.
EXPLOITATION CONFIDENCE
Vulnerability existence: CONFIRMED
Affected software: CONFIRMED
Patch availability: CONFIRMED
Automated exploitation attempts: CONFIRMED
CISA Known Exploited Vulnerabilities classification: CONFIRMED
Successful compromise count: NOT ESTABLISHED
Current widespread successful exploitation: NOT ESTABLISHED
Overall technical evidence confidence: HIGH
The available evidence supports classifying the vulnerability as actively targeted and known to have been exploited.
It does not support claiming that hundreds of thousands of WordPress websites were successfully compromised.
04 / WHAT WE DID
Actions taken
This section distinguishes confirmed public security responses from recommended incident-response procedures.
SecureMyWP has not performed customer remediation or independently reproduced exploitation as part of this report.
CONFIRMED SECURITY RESPONSE
WordPress Security Release
The WordPress Security Team released WordPress 7.1.4 on 28 October 2026.
Security fixes were also distributed for older WordPress branches.
Wordfence Protective Measures
Wordfence reported deploying a protective firewall rule to its Premium, Care and Response users on 28 October 2026.
The company stated that equivalent protection would become available to free users on 27 November 2026.
Protection against this particular attack requires appropriate firewall operation and configuration, including Extended Protection mode for Wordfence's relevant endpoint protection.
Threat Intelligence Publication
Wordfence published technical research describing the vulnerability, observed exploitation attempts and defensive recommendations.
CISA Vulnerability Classification
On 3 November 2026, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog.
This formally identified the vulnerability as requiring priority defensive attention based on evidence of exploitation.
RECOMMENDED WEBSITE RESPONSE
Identify the Installed WordPress Version
Check the currently installed WordPress core version.
Confirm whether the installation is running WordPress 7.1.4 or an appropriate patched release for its branch.
Review whether scheduled or automatic security updates have completed successfully.
Restrict Temporary Upgrade Directory Access
Where hosting access permits, configure the web server or reverse proxy to deny public HTTP access to:
/wp-content/upgrade/
Prevent directory listing within the temporary upgrade directory.
Apply these protections at the web server or reverse-proxy level rather than relying exclusively on security controls loaded through WordPress itself.
Hosting providers or qualified administrators should implement and validate these configuration changes.
Apply the Security Update
Update WordPress to version 7.1.4 or an applicable patched security release.
Verify that the update completed successfully.
Administrators of legacy installations should plan migration to a currently supported WordPress release.
Investigate Historical Upgrade Activity
Review web server access logs covering WordPress core upgrades performed on or after 28 October 2026.
Investigate requests targeting temporary upgrade files.
Correlate suspicious requests with the actual timing of WordPress updates.
Particular attention should be given to requests that received successful responses while temporary installation files were present.
Inspect Website Integrity
Verify WordPress core file integrity against trustworthy release files.
Review administrator accounts and privileges.
Inspect plugins and themes for unexpected changes.
Investigate unfamiliar PHP files, scheduled tasks and configuration modifications.
Examine the temporary upgrade directory for unexpected remaining files.
Preserve Evidence
Where compromise is suspected, preserve relevant logs, file metadata and suspicious files before destructive cleanup.
Document the approximate attack window, relevant requests and affected system components.
Perform Incident Recovery Where Necessary
If investigation establishes unauthorised code execution, treat the environment as potentially compromised.
Remove confirmed malicious components.
Identify and eliminate persistence mechanisms.
Restore clean files and databases where appropriate.
Rotate credentials and application secrets that may have been exposed.
Investigate the hosting environment for activity extending beyond the WordPress installation.
Verify Recovery
After remediation, confirm that:
WordPress is running a patched release.
Public access to temporary upgrade files is restricted.
Unexpected administrator accounts are absent.
Malicious files and persistence mechanisms have been removed.
Relevant credentials have been replaced.
File integrity checks pass.
Suspicious activity does not recur.
Applying the security update prevents future exploitation through this specific vulnerability but does not automatically remove malware introduced through a previous successful compromise.
05 / OUTCOME
Outcome
WordPress addressed CVE-2026-119977 through its 7.1.4 security release on 28 October 2026, with corresponding patched releases for older branches.
Wordfence subsequently documented substantial automated exploitation activity against the vulnerability.
By 5 November 2026, the company had reported more than 240,000 blocked exploitation attempts.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 3 November 2026.
These developments confirm that the vulnerability attracted real-world attacker activity and warranted urgent defensive attention.
However, the publicly reviewed evidence does not establish the number of WordPress installations successfully compromised.
The observed exploitation attempts should therefore not be interpreted as a verified count of affected websites.
The vulnerability is remediated for installations running WordPress 7.1.4 or the corresponding patched release for their branch.
Websites that remain on vulnerable releases may continue to face exposure during qualifying core upgrades.
Additionally, websites that experienced successful exploitation before patching may require comprehensive incident investigation and recovery.
The principal defensive recommendations are to verify WordPress patch status, restrict public access to temporary upgrade files and investigate suspicious activity associated with previous core updates.
SECUREMYWP SECURITY ASSESSMENT
Incident classification: EXPLOITATION OBSERVED
Technical severity: HIGH
Evidence confidence: HIGH
Patch status: AVAILABLE
Successful compromise count: NOT ESTABLISHED
Publication status: RECOMMENDED
This report is a public-source technical analysis based on official WordPress security announcements, Wordfence research, Patchstack vulnerability intelligence and CISA advisories.
It does not represent a SecureMyWP customer investigation, internal exploitation test or independently verified recovery outcome.
Assessment date: 11 November 2026.
06 / HARDENING
Hardening and prevention
The incident demonstrates the importance of protecting WordPress maintenance operations, not only the normal website application.
Recommended security controls include:
Maintain WordPress Core Updates
Install supported WordPress security releases promptly.
Verify that automatic background updates function correctly and investigate failed update notifications.
Restrict Public Access to Maintenance Directories
Ensure temporary installation and upgrade directories are not accessible to unauthorised external visitors.
Prevent unnecessary directory listing.
Implement Appropriate Web Server Protections
Configure Apache, Nginx or the relevant reverse proxy to restrict access to sensitive WordPress maintenance locations.
Validate configuration changes against normal website operation.
Maintain Effective Firewall Protection
Use suitable web application firewall protections.
Understand whether the firewall operates at the network, web server or application level.
Security controls implemented entirely within WordPress may not protect standalone PHP files that execute without loading the normal WordPress environment.
Monitor Core File Integrity
Compare WordPress core files with official release checksums.
Investigate unexpected changes to core PHP files and application configuration.
Maintain Reliable Backups
Store recoverable copies of WordPress files and databases.
Protect backups against unauthorised modification.
Test restoration procedures regularly.
Monitor Administrative Access
Review administrator accounts periodically.
Use strong authentication and multi-factor authentication where supported.
Remove unnecessary privileged accounts.
Improve Security Logging
Retain relevant web server access logs.
Record core update activity.
Monitor suspicious requests against sensitive directories.
Preserve sufficient historical information to investigate activity around previous updates.
Harden the Hosting Environment
Apply least-privilege file permissions.
Restrict unnecessary PHP execution.
Protect database credentials and application secrets.
Monitor unexpected outgoing connections and server processes.
Maintain Incident-Response Readiness
Document procedures for investigating suspicious activity.
Ensure administrators can preserve evidence, restore clean backups and rotate credentials.
Seek professional incident-response assistance when compromise cannot be confidently excluded or remediated.
No single preventative measure guarantees complete protection.
Layered controls, prompt patching and effective monitoring provide stronger protection against both known vulnerabilities and unexpected attack techniques.
07 / REPORT GOVERNANCE
Report governance
This public report is shown only because it satisfies SecureMyWP's governed publication requirements.
- PROVENANCE
- PUBLIC-SOURCE TECHNICAL ANALYSIS
- PUBLISHED
- 11 NOV 2026
- PUBLIC STATUS
- PUBLISHED