Hackers exploit WordPress flaw during software upgrades

How the flaw works

A vulnerability in WordPress Core, tracked as CVE-2026-119977, lets attackers take over websites during a core software update. The flaw is a time-of-check time-of-use (TOCTOU) race condition, which means an attacker can exploit a brief window when WordPress is updating itself. During this process, WordPress extracts files into a temporary directory that is often web-accessible and predictable. If an attacker reaches this directory in time, they can run the WordPress installer and supply their own database details. This allows them to create a configuration file that, in vulnerable versions, can overwrite the site's real configuration. The attacker then controls the site and can create an administrator account or run code on the server. No account on the target site is needed to exploit this.

The flaw affects WordPress versions 4.7 through 7.1.3, but research suggests even older versions may be at risk. The vulnerability was first described by Umut Bayram, who used AI tools to help find and exploit it. According to Hackread↗ (opens in a new tab), the underlying issue has existed since WordPress 2.7, released in 2008.

Who is affected

Any website running WordPress versions 4.7 to 7.1.3 is vulnerable if it performs core updates and its server allows web access and PHP execution in the temporary upgrade directory. The risk is higher for sites that have not yet applied the latest patch. According to The Hacker News↗ (opens in a new tab), more than 18,500 exploitation attempts were recorded within the first 21 hours after public disclosure. Attacks have been observed globally, with some attempts traced to the UK.

Is there a fix?

WordPress released version 7.1.4 on 28 October 2026 to address the vulnerability. The fix randomises the names of temporary directories, prevents directory listings, and blocks a staged configuration file from overwriting the live one. Security fixes were also backported to older branches down to 4.7. Versions before 4.7 did not receive a patch and should be upgraded to a supported release.

However, the first update to a fixed version still requires care. Administrators should deny web access to the wp-content/upgrade/ directory before starting the update and confirm that it returns a 403 (forbidden) response. This can be done via server configuration or the site's main .htaccess file. Alternatively, the update can be performed manually outside the public web directory.

The response

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalogue on 3 November 2026, confirming that attackers are exploiting the flaw in the wild CISA↗ (opens in a new tab). CISA has ordered US federal agencies to patch affected systems by 6 November 2026. Private organisations are strongly advised to review their WordPress installations and apply the patch immediately. CISA also recommends following its vulnerability management guidance and, if mitigations are unavailable, discontinuing use of the product.

What you should do

If you run a WordPress site, check your version and upgrade to 7.1.4 or the latest supported release. Before updating, restrict web access to the upgrade directory as described above. After updating, verify that the directory is no longer accessible from the web. For older sites, consider a manual update to avoid exposure during the upgrade process.