WordPress core upgrade flaw exploited after patch
CISA has confirmed active exploitation of a high-severity WordPress core upgrade flaw, with FCEB agencies given until November 6, 2026, to apply fixes, and a researcher says some sites can remain exposed while installing the fix.
IllustrationThe story so far
Defiant reported that threat actors began exploiting a high-severity WordPress race condition within hours of the October 28 patch in WordPress 7.1.4. The unauthenticated flaw in the Core update process can allow remote code execution through predictable, web-accessible staging paths, although attack complexity is high. Wordfence logged more than 18,500 requests targeting staged setup-config.php paths in the first 21 hours.
CISA later added the WordPress Core race condition, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw affects versions 4.7 through 7.1.3 and lets unauthenticated attackers run code during a full core upgrade by using predictable staging paths. FCEB agencies were given until November 6, 2026, to apply fixes, and a researcher said some sites remain vulnerable while installing the fix because the update can expose the installer in a temporary wp-content/upgrade folder.
Latest updates
3 updates · newest first- 6 NovNew development
WordPress sites can be hit while installing exploited fix
A researcher said some WordPress sites remain vulnerable while installing the fix for CVE-2026-119977, an actively exploited flaw in versions 4.7 through 7.1.3. The update unpacks files using old code and can expose the WordPress installer in a temporary wp-content/upgrade folder, letting an attacker run code if the folder name is known. The researcher advises blocking web access to that folder before updating.
The Hacker News ↗
- 4 NovOfficial statement
CISA confirms hackers exploiting WordPress core flaw during upgrades
CISA added a WordPress Core race condition, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The high-severity flaw lets unauthenticated attackers run code during a full core upgrade by using predictable staging paths. Wordfence logged more than 18,500 exploit requests in the first 21 hours after disclosure, and FCEB agencies have until November 6, 2026, to apply fixes.
Security Affairs ↗
- 30 OctNew development
Attackers exploit new WordPress update flaw hours after patch
Defiant said threat actors began exploiting a high-severity WordPress race condition within hours of the October 28 patch in WordPress 7.1.4. The unauthenticated flaw in the Core update process can allow remote code execution through predictable, web-accessible staging paths, though attack complexity is high. Wordfence logged more than 18,500 requests targeting staged setup-config.php paths in the first 21 hours.
SecurityWeek ↗