WordPress Update Vulnerability CVE-2026-119977: The Patch Install Itself Can Be Attacked, and How to Block the Window First

WordPress has fixed a flaw that attackers are targeting, but the update that installs the fix can itself be attacked for the few moments it is running. If your business website is not yet on a fixed release, block one folder from the web first, then update.

The flaw is CVE-2026-119977, and CISA added it to its Known Exploited Vulnerabilities catalog on November 3, 2026. The usual advice, "just update," leaves a gap here for any site that has not patched yet.

What is the WordPress update vulnerability CVE-2026-119977?

During a core update that uses a complete package, WordPress unpacks the new version into a temporary folder inside wp-content/upgrade, which web servers can usually reach. WordPress's advisory says an attacker with no login who wins a race against that process could reach remote code execution, meaning they could run their own code on your server.

Umut Bayram, the researcher WordPress credits, explains the mechanics in a Picus Security write-up. The temporary copy includes the WordPress installer. That installer does not notice the live site's configuration file, so it accepts setup requests from anyone.

WordPress's advisory lists WordPress 4.7 through 7.1.3 as affected. The fix shipped in WordPress 7.1.4 on October 28, 2026, with fixed releases for every branch back to 4.7.

Why installing the WordPress patch is itself exposed

The fix gives the temporary folder a random name, protects the file that stops the folder being listed, and stops wp-config.php being overwritten. Picus explains why that only partly helps on the day you install it: your old updater does the unpacking, and only the copying step uses the new code.

So the configuration file is protected during that update, but the folder name is not. Picus says the temporary installer is "still reachable at a predictable path." An attacker who hits that moment can connect the temporary copy to their own database, log in and run PHP code until cleanup, and from there read or write the live site. Wordfence says the update "will run the vulnerable upgrade process one last time."

The gap is brief. Wordfence says the window was observed to last only seconds. Picus gives no figure.

Partial packages are not a guarantee. Picus says one exposes a site only if that archive contains the installer files. We checked WordPress's update service on November 9, 2026. A 7.1.3 site is offered 7.1.4 with both a partial and a complete package. A 7.0.7 site is offered 7.1.4 as a complete package only, plus an automatic update to 7.0.8 that has both. We did not open those archives. The 7.1.3 updater code also switches to the complete package when a core file fails its checksum check, and on a reinstall. Block the folder either way.

WordPress CVE-2026-119977: what is confirmed and what is not

Confirmed by primary sources:

• WordPress lists the upgrade weakness among the fixes in 7.1.4 and credits Bayram.
• CISA lists the flaw as exploited, added November 3, with a November 6 due date in its catalog.

Reported by Wordfence from its own firewall data:

• It deployed a blocking rule at 20:30 UTC on October 28, and the first match came nine minutes later.
• It recorded more than 18,500 requests aimed at the temporary installer paths in the first 21 hours.
• By its November 5 post it had blocked over 240,000 attempts, peaking at over 74,000 on October 30.
• Some sources repeatedly polled limited groups of sites for roughly 14.5 hours, which Wordfence calls behavior consistent with trying to catch the brief upgrade window.

Not known:

• How many sites have been compromised. Wordfence says, "The large number of blocked requests does not mean that a large number of sites have been successfully exploited," and that most are likely automated attempts.
• Who is behind the attacks. CISA's entry gives no attack details and lists ransomware use as unknown.
• How serious it really is for your site. WordPress's advisory rates it Low, while Wordfence scores it 8.1 of 10 (High). The difference matters less than the fact that attempts are happening.

How to fix the WordPress update vulnerability this week

Fixed versions: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34, 4.7.39.

Signs to look for (from Wordfence): requests to PHP files under wp-content/upgrade, leftover files or folders there, unfamiliar administrator accounts and plugins nobody installed. Wordfence notes that no legitimate upgrade needs outside requests to those files.

How to block wp-content/upgrade before updating

These rules come from Picus. Wordfence gives similar advice, blocking PHP files in that folder at the web server level before updating.

On Nginx:

location ^~ /wp-content/upgrade/ { deny all; }

On Apache with access to the virtual host, add a Directory block for that folder containing Require all denied.

With only .htaccess, add this to the file in the WordPress root, above the WordPress rewrite rules:

RedirectMatch 403 ^/wp-content/upgrade/

Do not put an .htaccess file inside wp-content/upgrade, because the old updater deletes that folder's contents before unpacking. The researcher told The Hacker News the block does not interfere with updates, because WordPress works on that folder directly on disk.

The alternative is a manual update: back up, unpack the release outside the web root, copy the core files without touching wp-config.php or wp-content, then run the database update.

WordPress update vulnerability questions people are asking

Is it safe to install WordPress 7.1.4?

Yes, and you should. The risk is only in the moments the update runs on an unpatched site, so block the folder first.

Do automatic WordPress updates protect my site?

They deliver the fix. WordPress says the process begins automatically on sites that support background updates. Wordfence says most sites should receive it that way, but recommends checking rather than assuming it completed. That update also ran the old updater, so review your logs.

Is WP-CLI safer than the dashboard?

No. Picus says wp core update uses the same vulnerable updater and is not a substitute.

Will maintenance mode stop this attack?

None of the sources we read list it as a mitigation. Use the web server block.

Does a Wordfence firewall cover this?

Paid Wordfence customers received the rule on October 28. Free users get it on November 27, 2026, so do not count on it before then.

My site already updated. Am I done?

Confirm the version, then run step 6. Any later update will use a random folder name.

Why this matters for a company website

A website is often connected to customer forms, orders and the database behind them. Someone who can read or write the live site's files can reach wp-config.php, which holds the database login. Background updates also run on no schedule you chose, which is why attackers polling sites and waiting makes sense.

If a hosting company manages your site, ask them directly whether the folder was blocked and whether they reviewed logs from your update. Our posts on why WordPress sites get hacked and who is patching the software that runs your business cover how to assign that responsibility, and updated is not the same as patched explains why a version number deserves a second look.

The bigger lesson

The update process is part of your attack surface. Patching quickly is still right, but the order of steps and the check afterward are what make it safe.

For help locking down a site before the next update, see security hardening or get a quote.

Get security alerts by email, with the free checklist, at /security-alerts.

Sources: WordPress 7.1.4 release post; WordPress security advisory; WordPress 7.1.3 updater code; WordPress update service for 7.1.3; WordPress update service for 7.0.7; CISA KEV catalog; Picus Security; Wordfence, October 29; Wordfence, November 5; Wordfence research feed, full text of both posts; The Hacker News.