WordPress RCE Vulnerability CVE-2026-119977: Exploit Attempts Began Hours After the 7.1.4 Fix

A flaw in WordPress itself, not in a plugin, can let an attacker with no login run their own code on a website while that site is installing a core update. WordPress fixed it on Wednesday, October 28, 2026, in version 7.1.4 and in matching updates for every branch back to 4.7. Security firm Wordfence says attackers started probing for it within hours, so check every WordPress site your business runs this week.

What happened with the WordPress 7.1.4 security update

WordPress released 7.1.4 on Wednesday, October 28, 2026. The first item on its list of security fixes is a weakness in the upgrade process "that can lead to remote code execution during the upgrade window." Researcher Umut Bayram reported it.

WordPress published a GitHub advisory (GHSA-4w3m-c66w-69mg) on Thursday, October 29. It explains how the flaw works. During a core update that uses a complete WordPress package, older versions unpacked the new files into a predictable folder inside the upgrade directory, and that folder could be reached from the web. An attacker with no account who wins a race against that unpacking could get remote code execution, which means running their own code on your server.

Put simply, an attack needs four things:

• A core update that uses the full WordPress package
• An upgrade folder that the public can reach, with PHP running inside it
• A folder path the attacker can predict or find
• Good timing, because WordPress deletes the temporary files when the update finishes

The release post lists 11 other security items besides this flaw, most of them stored cross-site scripting issues that need a logged-in Contributor account or higher. It also updates the bundled root certificates because of the eMudhra revocation, which we covered in eMudhra Certificate Compromise. WordPress.org's version page puts the total for the release at 22 vulnerabilities.

What is confirmed and what is only claimed

Confirmed from primary sources:

• Affected versions: WordPress 4.7.0 through 7.1.3, on every branch, per the WordPress advisory and the CVE record.
• CVE number: CVE-2026-119977. Wordfence, which is allowed to assign CVE numbers, published the record on Saturday, October 31, 2026. It credits Umut Bayram as the finder.
• Severity: The CVE record scores it 8.1 (High) on CVSS 3.1, with attack complexity rated High. WordPress's own GitHub advisory labels it Low and lists no CVE. Both are primary sources and they disagree. Our view: any single attempt is hard to time, but automated tools can keep trying for as long as they like.
• Attack activity: Wordfence wrote on Thursday, October 29 that it deployed a firewall rule at 20:30 UTC on October 28, about three hours after the release, and saw the first match nine minutes later. It recorded "more than 18,500 requests targeting staged setup-config.php installer paths" in the first 21 hours. Two of the largest sources polled the same limited sets of sites for about 14.5 hours. In lab tests the race window lasted only seconds.

Claimed, not confirmed:

• The Hacker News reported on Friday, October 30 that Wordfence blocked 62,969 attacks in 24 hours. We could not find that figure in the Wordfence post we read, so treat it as reported, not verified.
• Neither WordPress nor Wordfence says any site has been broken into. How many sites, if any, were compromised is not known.
• Neither source says which routine updates take the full-package path. Until that is clear, treat any core update on an unpatched site as a possible window.

Which WordPress versions are fixed

The GitHub advisory lists the fixed version for every branch in between. WordPress only actively supports the newest version, so 7.1.4 is the right target if you can get there.

How to check your WordPress site this week

1. Find your version. In the dashboard, go to Dashboard > Updates. If you use WP-CLI, run wp core version on the server.
2. Update. Install 7.1.4, or the fixed version for your branch from the table. WordPress says sites with automatic background updates will update on their own, but confirm the version number anyway.
3. Check every site, not just the main one. Staging copies, old campaign sites and forgotten subdomains run the same code.
4. Search your logs. Wordfence advises looking for unexpected requests to PHP files under wp-content/upgrade, such as setup-config.php.
5. Look for signs of a break-in. Wordfence also lists unfamiliar administrator accounts, plugins you did not install, and PHP files you did not put there.
6. Add a layer (our suggestion). Blocking web access to wp-content/upgrade at the web server removes one of the four conditions above. Test it on a staging copy first. It is a backup, not a replacement for updating.
7. Do not count on the free firewall. Wordfence says its rule reaches free users on Friday, November 27, 2026, 30 days after paid customers.
8. Ask your host or developer. If someone else manages the site, ask them in writing which version it runs today.

Why this matters for a business website

Most WordPress attacks go through plugins. This one is in core, so it touches almost every WordPress site still on a supported branch, including well-kept ones. It also turns the update itself into the risky moment, and attackers were watching for that moment within hours of the fix.

For a company, a hacked website means more than a defaced page. Attackers can use it to send phishing to your customers, hide malware in your downloads, or reach other systems on the same server. We explain the wider pattern in Why WordPress Is the Most Targeted Website Platform on the Internet.

The harder question is ownership. If nobody can tell you today which version each site runs, that is the gap to fix. See Who Is Patching the Software That Runs Your Business? and Updated Is Not the Same as Patched.

WordPress RCE vulnerability questions people are asking

Is WordPress 7.1.3 vulnerable?

Yes. Every version from 4.7.0 through 7.1.3 is affected unless it has the fixed version for its branch.

What version fixes the WordPress RCE vulnerability?

WordPress 7.1.4. Older branches have their own fixes, for example 7.0.8, 6.9.11 and 6.8.12.

Is this a WordPress plugin vulnerability?

No. It is in WordPress core, in the code that installs core updates.

Does the attacker need a login?

No. The advisory says an attacker with no account can exploit it, but they have to hit a window that lasts seconds.

Does the WordPress flaw have a CVE?

Yes. It is CVE-2026-119977, published October 31, 2026. Early news reports said it had no CVE because the record did not exist yet.

Is the 63,000 attacks figure true?

It was reported by The Hacker News, citing Wordfence. The Wordfence post we read gives more than 18,500 requests in the first 21 hours.

Was my site hacked?

Nobody has confirmed any break-ins. Update first, then check your logs and admin accounts as in the checklist.

Will automatic updates fix it?

WordPress says sites with background updates turned on will update on their own. Check the version number to be sure.

The bigger lesson

A security release is also a public map for attackers, and this time they went after the update process itself within hours. Speed matters, and so does knowing exactly which sites you run and who answers for each one.

Want every site checked and kept current? See security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at /security-alerts.

Sources: WordPress.org: WordPress 7.1.4 release; WordPress GitHub advisory GHSA-4w3m-c66w-69mg; CVE-2026-119977 record; WordPress.org: Version 7.1.4; Wordfence: WordPress 7.1.4 upgrade-window RCE.