WordPress Flaw Exploited During Core Updates (CVE-2026-119977): What Website Owners Should Check

On October 28, 2026, WordPress released version 7.1.4, a security update that fixes 22 vulnerabilities. One of them is now being exploited: CVE-2026-119977, a flaw in the way WordPress updates itself. While a site is installing a core update, an attacker who reaches a temporary copy of WordPress at the right moment may be able to run code on the server, without logging in.

On November 3, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its catalog of known exploited vulnerabilities. If your business website runs on WordPress, this guide explains what the flaw does, how to check your version and what to do in the next hour.

The flaw at a glance

What actually goes wrong

When WordPress installs a full core update, it first unpacks the new version into a temporary folder under wp-content/upgrade and only then moves the files into place. In affected versions, that temporary folder has a predictable name and, on many hosts, can be reached from the internet for as long as it exists.

The temporary folder contains a complete copy of WordPress, including its setup wizard. Researchers describe how an attacker who opens that setup wizard before WordPress cleans up the folder may be able to point it at a database they control and get PHP code running on the server. From there, the attacker effectively controls the website.

The window is short, often only seconds, which is why the severity is “high” rather than “critical”. But attackers automate it: they repeatedly request the likely paths and wait for a site to start updating. Wordfence, which runs a widely used WordPress firewall, reported blocking tens of thousands of such attempts per day in the first days after the release. Reports so far speak of attempts, not confirmed break-ins, but CISA lists the flaw as exploited.

Version 7.1.4 fixes the problem by giving the temporary folder a random name and blocking the staged setup wizard. The flaw was reported by researcher Umut Bayram.

“Some security flaws only exist for a few seconds. Automated attacks are built to be there for those seconds.”

NyorsoftExternal Security Review

Are you affected?

1. Check your WordPress version. In the dashboard go to Dashboard → Updates, or look at the bottom right of any admin page. Anything from 4.7 up to and including 7.1.3 is affected. If you are on an older branch, the fixed version for that branch is listed in the table below.
2. Check when the site last updated. Automatic background updates usually installed 7.1.4 within a day or two of October 28. The risky moment is the update itself, so a site that updated after attacks began is the one to look at more closely.
3. Do not forget other WordPress installs. Old landing pages, a staging copy, a second site for a branch office: every one of them runs the same update process.

WordPress only actively supports the newest version, so the safest target is always the current release.

What to do now

1. Update to a fixed version and confirm the version number afterwards. Take a backup first.
2. Block web access to the update folder. Ask your host or developer to deny direct HTTP requests to /wp-content/upgrade/. WordPress writes to that folder through the file system, so normal visitors never need it. Test the rule on a staging copy first, as some managed hosts handle updates differently.
3. Keep automatic updates on for security releases, so the next fix arrives without anyone having to remember it.
4. Update plugins and themes in the same session. The same release cycle fixed many other issues, and plugins are still the most common way in, as we described in our article on compromised WordPress plugins.

How to tell if someone tried

Because WordPress deletes the temporary folder after a successful update, the evidence is in the web server logs, not on disk. Ask your host or developer to check, for the period since October 28:

• Requests to paths under /wp-content/upgrade/, especially ones containing setup-config.php or install.php. Legitimate traffic should not request these.
• Unknown administrator accounts, plugins you did not install, or PHP files with recent modification dates in the WordPress folders.
• Unexpected changes to wp-config.php or unusual outgoing connections from the web server.

If anything looks wrong, take the site offline or put it in maintenance mode, keep the logs, change the passwords for WordPress, hosting, database and FTP, and restore from a clean backup made before the suspicious activity.

The broader lesson

This flaw is unusual because it lives in the update process itself, but the advice is the familiar one: know which software your website runs, install security updates quickly, and keep an eye on what the site exposes to the internet. It is the fourth widely used web platform under active attack in a few weeks, after PHP2Shell, the WordPress plugin compromises and Drupal Commerce.

Our free website security check shows in seconds what your site reveals from the outside, such as missing security headers and email protection. A Public Website Security Check goes further, including visible software versions and exposed files and folders.

Sources

• WordPress.org: Version 7.1.4 release notes and fixed branches
• Pantheon: WordPress 7.1.4 release note
• CISA: Known Exploited Vulnerabilities Catalog
• SOC Prime: CVE-2026-119977, WordPress Core RCE exploited during upgrades
• DEV Community: The WordPress core RCE that only exists during an update
• Webhosting.Today: WordPress update flaw draws tens of thousands of attack attempts

This article summarises public information as of November 6, 2026. Check WordPress.org and CISA for the latest guidance.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team