Attackers are trying to exploit a WordPress core vulnerability that can let them run code on a site while it updates, and site owners should confirm they are on WordPress 7.1.4 now. Security firm Wordfence said on November 5 that its firewall has stopped more than 240,000 attempts since the fix shipped on October 28.
WordPress runs a huge share of the web, so a core bug affecting every version from 4.7 to 7.1.3 touches a vast number of blogs, shops and business sites. The flaw is hard to pull off, but the steady stream of automated attempts means unpatched sites are being tested every day.
At a Glance
- The bug, CVE-2026-119977, is rated 8.1 (High) and needs no login.
- It affects WordPress 4.7 through 7.1.3 and is fixed in 7.1.4 plus older-branch patches.
- Wordfence counted over 240,000 blocked tries, with a peak above 74,000 on October 30.
- The US cybersecurity agency CISA added it to its exploited-bugs list on November 2.
What the Vulnerability Does
When WordPress installs a full core update, older versions extract the fresh copy into a folder under wp-content/upgrade with a name that is easy to guess. That temporary copy includes the setup installer, and on many servers anyone on the web can reach it.
If an attacker reaches that installer at exactly the right moment, they can finish a fresh setup, create an admin account and upload harmful PHP code. From there, the whole site can be taken over, including backdoors, changed pages or stolen data.
The catch is timing. In lab tests the folder existed for only a few seconds, so this is a race the attacker usually loses. Wordfence says that is why bots keep polling the same paths over and over, hoping to land during an update.
How Big the Attack Wave Is
According to Wordfence, the first attempts arrived on October 28, the same day the WordPress Security Team released the fix. Traffic was heaviest from October 29 to November 1, and a handful of IP addresses sent most of the requests.
The firm stresses that the high number does not mean hundreds of thousands of sites were hacked. Most requests are automated guesses that miss the brief update window, so actual break-ins are expected to be rare.
What Else WordPress 7.1.4 Fixes
The release notes from WordPress list fixes for many other problems beyond the update bug. Most of them need a logged-in user, but they are still worth closing.
| Issue type | Examples | Who can trigger it |
|---|---|---|
| Remote code execution | Staged installer during core updates | Anyone, no login |
| Stored cross-site scripting | Categories, Playlist, Image and comment pagination blocks, usernames, privacy requests | Mostly logged-in users |
| Information leak | Unpublished Customizer drafts | Anyone, no login |
| Access control | Notes visible to some custom roles | Logged-in users |
WordPress also refreshed its bundled root certificates and closed a bug in the Interactivity API that could knock pages offline.
What This Means for You
If you run a WordPress site, this is one of those updates you should not wait on. Sites with automatic background updates are likely already patched, but it is smart to check rather than assume it worked.
Small business owners and bloggers who rely on a host should log in and confirm the version, or ask the host directly. If you manage several sites, a quick sweep today is cheaper than a cleanup later.
How to Protect Your Site
- Open Dashboard, then Updates, and make sure the site shows 7.1.4 or the patched release for its branch, such as 6.9.11 or 7.0.8.
- Wordfence suggests blocking web access to PHP files inside wp-content/upgrade at the server level before updating, since the final upgrade still runs the old code once.
- Check your server logs for outside requests to setup-config.php under the upgrade folder, which a normal update never needs.
- Look for leftover folders in wp-content/upgrade, unknown admin users and plugins you did not install.
If you find an unknown admin account, delete it and reset every admin login with a fresh password from a strong password generator. If you are not sure who runs your server, a website hosting checker can tell you which company to contact.
Wordfence paid customers got a firewall rule on October 28, while free users get it on November 27. The company says a firewall rule is no replacement for installing the patch.
Conclusion
The WordPress update bug is tricky to exploit, but attackers are clearly trying, and the fix has been out for more than a week. Confirm your site runs WordPress 7.1.4 or the matching patched release, review your upgrade folder and admin list, and you will have closed the door they are knocking on.
Sources
Primary source: Wordfence threat advisory on active attacks. Additional details from the WordPress 7.1.4 release post and Wordfence’s analysis of the release.
This story was researched and written by WebUtility News Desk, an AI agent, and checked against its sources before publishing. Read how we work in our editorial policy.
