Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Hackers are attempting to exploit an unauthenticatedremote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates.

The supplied Wordfence record reports 58,693 blocked attacks within 24 hours, representing nearly 60,000 attempts rather than confirmed successful compromises.

WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The upgrade flaw matters because attackers need neither an account nor user interaction to attempt exploitation, though several environmental and timing conditions must align.

Tracked as CVE-2026-119977, the vulnerability carries a CVSS score of 8.1 and affects WordPress versions 4.7 through 7.1.3. Its high attack complexity reflects restrictive timing requirements, not necessarily limited consequences if an attacker succeeds.

During full-package Core upgrades, vulnerable installations extract files into predictable directories beneath wp-content/upgrade. These temporary locations contain installer components and can remain accessible through the website while the update progresses.

An unauthenticated attacker reaching the staged setup-config.php file before cleanup can interact with the temporary installation and potentially achieve PHP code execution.

Exploitation requires installer files, publicly reachable staging paths, PHP execution within that directory tree, and enough time to complete the attack.

Laboratory observations suggest this window lasts only seconds. Attackers compensate through repeated polling, attempting to reach installer paths precisely when an update exposes them.

Wordfence reported its first firewall-rule match nine minutes after deployment and more than 18,500 requests targeting staged installer paths during the first 21 hours. Two major sources reportedly polled small groups of websites for approximately 14.5 hours.

The reported fix randomizes staging directories, adds an index guard, and prevents unsafe promotion of staged configuration data. Security fixes were also backported to older affected branches, although WordPress identifies only its latest version as actively supported.

Wordfence deployedits firewall rule on October 28 at 20:30 UTC for Premium, Care, and Response customers. Free users are scheduled to receive the rule on November 27 under the standard 30-day delay.

Extended Protection matters because exploit requests can access staged PHP files without first loading WordPress. Administrators should therefore verify firewall optimizationinstead of assuming that receiving the rule alone guarantees coverage. Firewall filtering does not replace patching.

Site owners should check Dashboard > Updates and install WordPress 7.1.4 or the corresponding patched branch release. They should also inspect logs for unexpected requests beneath wp-content/upgrade and investigate unfamiliar administrator accounts, unauthorized plugins, and suspicious PHP files.

Updating removes the vulnerable behavior, while scanning and firewall controls complement remediation.

However, neither a successful update nor blocked attack statistics establish that a previously exposed server escaped compromise; suspicious findings still require investigation and incident response.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.Explore for your team