On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects WordPress core versions 4.7 through 7.1.3 and can be leveraged by unauthenticated attackers to execute code on the server during a core upgrade, which can lead to complete site compromise. Since this is a race condition vulnerability that can only be exploited during the short window while a core upgrade is in progress, successfully exploiting it to achieve remote code execution is difficult in practice. Our records indicate that attackers started targeting this vulnerability on the same day it was disclosed. The Wordfence Firewall has already blocked over 240,000 exploit attempts targeting this vulnerability.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in WordPress core on October 28, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on November 27, 2026.
This vulnerability was also added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog on November 2, 2026.
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
Considering threat actors are actively attempting to exploit this vulnerability, we urge users to ensure their sites are updated to WordPress 7.1.4, or the corresponding patched security release for their branch, as soon as possible. WordPress sites with automatic background updates enabled should already have been updated to a patched version.
Since the vulnerability lies in the upgrade process of the currently installed WordPress version, updating from a vulnerable version to the patched version will run the vulnerable upgrade process one last time. However, this window only lasts as long as the update itself, and once the site runs a patched version, future upgrades are no longer affected. For this reason, we still recommend updating as soon as possible rather than postponing the update. As an additional precaution, site owners can block access to PHP files in the /wp-content/upgrade/ directory at the web server level before updating. Wordfence Premium, Wordfence Care, and Wordfence Response users with an optimized firewall running in Extended Protection mode are already protected against this attack during the update.
Vulnerability Summary from Wordfence Intelligence
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
8.1 (High)
<div>
CVE-ID<br />
<strong>
<a href="https://www.cve.org/CVERecord?id=CVE-2026-119977" rel="noreferrer" target="_blank"> CVE-2026-119977 </a> </strong>
</div>
<div>
Affected Version(s)<br />
<strong>Various <i></i></strong>
</div>
<div>
Patched Versions<br />
<strong>4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4</strong>
</div>
</div>
<div>
<div>
<strong>Affected Software</strong><br />
<div><a href="https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/" rel="noreferrer" target="_blank">WordPress</a> [wordpress]</div> </div>
<div>
<strong>Researcher</strong><br />
<div>
<div><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/umut-bayram" rel="noreferrer" target="_blank"><img alt="" src="https://www.gravatar.com/avatar/00000000000000000000000000000000.jpg?s=32&d=mp&r=g" /></a><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/umut-bayram" rel="noreferrer" target="_blank">Umut Bayram</a></div> </div>
</div>
</div>
<div>
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. </div>
</div>
<div>
<a href="https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250" rel="noreferrer" target="_blank">More Details ></a>
</div>
Vulnerability Details
We covered the full technical details of this vulnerability in a dedicated blog post, which we recommend reading for a complete analysis:
WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE
A Closer Look at the Attack Data
The following data highlights actual exploit attempts from threat actors targeting this vulnerability. In the attacks we have observed, threat actors are sending requests to the installer files located in the predictable staging directory under /wp-content/upgrade/, attempting to reach a site while a core upgrade is in progress.
GET /wp-content/upgrade/wordpress-6.9.11/setup-config.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: [redacted]
If the installer is reachable, the attacker can complete the staged installation, create an administrator account for it, and upload malicious PHP code to the server. This gives the attacker a foothold from which the entire site can be compromised, including installing backdoors, modifying existing content, or exfiltrating sensitive data.
Wordfence Firewall
The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.
Please note that because the exploit targets standalone PHP files in the staging directory that do not load WordPress, the Wordfence firewall must be optimized and running in Extended Protection mode in order to inspect and block these requests.
Total Number of Exploits Blocked
The Wordfence Firewall has blocked over 240,000 exploit attempts since the vulnerability was publicly disclosed.
According to our data, attackers began targeting websites on October 28th, 2026, the day the vulnerability was disclosed, with only a small number of attempts on that first day. The highest volume of attacks occurred between October 29th and November 1st, 2026, peaking on October 30th when over 74,000 exploit attempts were blocked in a single day.
A Note on These Numbers
The large number of blocked requests does not mean that a large number of sites have been successfully exploited. The majority of these requests are most likely automated attempts sent to the predictable staging path in the hope of reaching a site at the exact time a core upgrade is in progress. Since this is a race condition vulnerability, a request only has a chance of succeeding if it arrives during the short upgrade window, and the attacker must complete the entire attack before the staging directory is removed. As a result, successful exploitation leading to remote code execution is difficult in practice.
Top Offending IP Addresses
The following IP Addresses are currently the most actively engaged IP addresses targeting this vulnerability:
- 103.59.160.171
- Over 74,900 blocked requests.
- 2001:df1:e8c0::106b
- Over 40,400 blocked requests.
- 51.89.103.78
- Over 34,600 blocked requests.
- 185.177.72.61
- Over 4,400 blocked requests.
- 195.3.220.7
- Over 2,900 blocked requests.
- 96.62.218.148
- Over 2,300 blocked requests.
- 20.217.186.29
- Over 2,000 blocked requests.
- 87.58.197.83
- Over 2,000 blocked requests.
- 154.26.238.8
- Over 1,800 blocked requests.
- 20.46.43.126
- Over 1,700 blocked requests.
Indicators of Compromise
We recommend reviewing your web server access logs for any requests to PHP files under the /wp-content/upgrade/ directory, particularly requests to setup-config.php, as no legitimate upgrade process requires external requests to these files. Requests originating from the following IP addresses should be treated as especially suspicious:
- 103.59.160.171
- 2001:df1:e8c0::106b
- 51.89.103.78
- 185.177.72.61
- 195.3.220.7
- 96.62.218.148
- 20.217.186.29
- 87.58.197.83
- 154.26.238.8
- 20.46.43.126
It is also recommended to review the /wp-content/upgrade/ directory for any leftover files or directories, and to review the list of installed plugins and WordPress users for anything unexpected.
If you find evidence of compromise, we recommend removing any unexpected files, plugins, and unknown administrator accounts, and reviewing the site for backdoors. The absence of any such log entries does not guarantee that your website has not been compromised.
Conclusion
In today’s article, we covered the attack data for an Unauthenticated Remote Code Execution vulnerability in WordPress core, affecting versions 4.7 through 7.1.3, that allows unauthenticated threat actors to execute code on the server during a core upgrade, leading to complete site compromise. Although this race condition vulnerability is difficult to exploit, as it can only be exploited during the short window while a core upgrade is in progress, our threat intelligence indicates that attackers began targeting this vulnerability the same day it was disclosed, on October 28th, 2026, with the highest volume of attacks occurring between October 29th and November 1st, 2026. The Wordfence firewall has already blocked over 240,000 exploit attempts targeting this vulnerability.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in WordPress core on October 28, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on November 27, 2026.
We strongly urge all WordPress users to ensure their sites are running WordPress 7.1.4 or the corresponding patched security release for their branch. While the update to the patched version itself still runs through the vulnerable upgrade process, this is a one-time, short window, and blocking access to PHP files in the /wp-content/upgrade/ directory at the web server level before updating provides additional protection. If you have friends or colleagues running WordPress sites, be sure to forward this advisory to them, as sites could still be unprotected and unpatched.
If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.
The post Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core appeared first on Wordfence.
Article Link: https://www.wordfence.com/blog/2026/11/attackers-actively-probing-for-upgrade-window-rce-vulnerability-in-wordpress-core/