Cyberattacks | Vulnerabilities

Attackers Probe WordPress Updater RCE Flaw 60,000+ Times a Day

Attackers started hammering a no-login code execution bug in WordPress’s update process hours after the fix shipped. Update now.

By Content Team

Nov 2, 2026

ON THIS PAGE

Attackers started targeting a no-login remote code execution flaw in WordPress’s core updater nine minutes after Wordfence deployed a firewall rule for it on October 28, 2026, the day WordPress 7.1.4 shipped the fix. By October 30, Wordfence was blocking more than 60,000 attempts in any 24 hours. It has reported no confirmed compromises.

The flaw, CVE-2026-119977 (CVSS 8.1, High), affects versions 4.7 through 7.1.3. Predictable temporary folder names let an attacker reach a staged installer during a full core update. The window usually lasts seconds, and wp-content/upgrade/ must be reachable from the web.

Admins should update to 7.1.4, or their branch’s patched release back to 4.7.39, and confirm it installed rather than trust automatic updates; 4.6 and earlier get no fix. Paid Wordfence customers have the rule, but free users wait until November 27. Meanwhile, block web access to wp-content/upgrade/; plugin firewalls only catch this when set to load before WordPress.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?