Attackers started hammering a newly patched WordPress flaw within minutes of a fix shipping, trying to catch the few seconds during a core update when a site can be tricked into running their code. The bug affects every WordPress release from 4.7.0 through 7.1.3, and it needs no account on the target site.
WordPress 7.1.4, released on October 28, fixes 22 security vulnerabilities. The most serious, tracked as CVE-2026-119977 and rated 8.1 (High) on the CVSS scale, is an unauthenticated race condition in the core update process that can lead to remote code execution. Alex Thomas of Wordfence reports that the company's firewall saw its first matching attack request nine minutes after its new rule went live. The flaw was reported by researcher Umut Bayram.
A few seconds is all an attacker needs
When WordPress installs a full core update package, affected versions unpack the new files into a predictable directory under wp-content/upgrade. That temporary copy includes the WordPress installer. On many servers the staging directory is reachable from the web, so an unauthenticated attacker who requests the staged installer at precisely the right moment can interact with that copy of WordPress and work up to running PHP code on the server.
The catch, for the attacker, is timing. Wordfence says the vulnerable staging directory normally existed for only seconds in its lab tests, and exploitation also requires a full-package update containing the installer files, public web and PHP access to the staging tree, and a staging path the attacker can predict or discover. A single request is unlikely to land. Repeated automated polling improves the odds, and that is exactly what attackers are doing.
18,500 requests in the first 21 hours
Wordfence deployed a blocking firewall rule at 20:30 UTC on October 28, roughly three hours after the release. In the first 21 hours it recorded more than 18,500 requests aimed at staged setup-config.php installer paths. Two of the largest sources repeatedly polled small groups of sites for about 14.5 hours, behavior consistent with waiting for an update to begin. Other sources cycled through variations of staging-directory and version names.
Not every request used the exact vulnerable path, Wordfence notes, but the sustained polling and the exact-layout probes show that attackers understood the race condition quickly. The exploit requests the staged PHP file directly without loading WordPress first, so Wordfence advises users of its firewall to confirm that Extended Protection is enabled, which lets the firewall run ahead of direct PHP requests.
The other 21 fixes
The rest of the release addresses multiple stored cross-site scripting bugs across blocks, the Customizer and usernames, several Interactivity API issues including prototype pollution and a persistent denial of service condition, an unauthenticated information disclosure that could expose unpublished Customizer changesets, and an authorization weakness in the Notes REST API. Bundled root certificates were also updated following the eMudhra revocation. Many of these require a Contributor, Author or Editor account, which lowers their exposure, but stored cross-site scripting can still lead to account takeover when a privileged user views a malicious page.
WordPress plugins have been a steady target this month, from stolen UpdraftCentral keys used to plant malware to booby-trapped comments that hijack Duplicator migrations. This one sits in WordPress Core itself.
Confirm you are on 7.1.4 or your branch's fix
- Go to Dashboard, then Updates, and confirm the site runs WordPress 7.1.4 or the patched release for its branch. Fixes were backported as far as 4.7.39, including 6.8.12, 6.9.11 and 7.0.8. Do not assume the automatic background update completed.
- WordPress 4.6 and earlier no longer receive security updates and should be moved to a supported release.
- If a site stayed unpatched, look for unexpected requests to PHP files beneath wp-content/upgrade, unfamiliar administrator accounts, unexpected plugins, and PHP files you did not place there.
- A firewall rule reduces exposure while you update, but only the fixed core version removes the vulnerable behavior. Wordfence's free tier receives the rule on November 27, 2026.
The window this bug opens is tiny, and Wordfence rates the attack complexity as high. But attackers have shown they are willing to sit and wait for it, and any unpatched site that runs a full core update briefly opens it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.