Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core

On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects WordPress core versions 4.7 through 7.1.3 and can be leveraged by unauthenticated attackers to execute code on the server during a core upgrade, which can lead to complete site compromise. Since this is a race condition vulnerability that can only be exploited during the short window while a core upgrade is in progress, successfully exploiting it to achieve remote code execution is difficult in practice. Our records indicate that attackers started targeting this vulnerability on the same day it was disclosed. The Wordfence Firewall has already blocked over 240,000 exploit attempts targeting this vulnerability.

Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in WordPress core on October 28, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on November 27, 2026.

This vulnerability was also added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog on November 2, 2026.

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977

Considering threat actors are actively attempting to exploit this vulnerability, we urge users to ensure their sites are updated to WordPress 7.1.4, or the corresponding patched security release for their branch, as soon as possible. WordPress sites with automatic background updates enabled should already have been updated to a patched version.

Since the vulnerability lies in the upgrade process of the currently installed WordPress version, updating from a vulnerable version to the patched version will run the vulnerable upgrade process one last time. However, this window only lasts as long as the update itself, and once the site runs a patched version, future upgrades are no longer affected. For this reason, we still recommend updating as soon as possible rather than postponing the update. As an additional precaution, site owners can block access to PHP files in the /wp-content/upgrade/ directory at the web server level before updating. Wordfence Premium, Wordfence Care, and Wordfence Response users with an optimized firewall running in Extended Protection mode are already protected against this attack during the update.