Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

We flagged WordPress 7.1.4 on Thursday and called its one no-login bug hard to hit. Attackers are trying anyway. Wordfence says the first attempts arrived nine minutes after it shipped a blocking rule, and the bug got a CVE on Saturday.

The trick is timing. The flaw only opens while WordPress is unpacking a full core update, so attackers poll the same few paths over and over and wait for a site to start one.

The riskiest few seconds for an old WordPress site are the ones it spends updating, and scanners are already polling for them.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Scanners are waiting for the seconds a WordPress update takes

Wordfence, which assigned CVE-2026-119977, rates it CVSS 8.1 with high attack complexity. Versions 4.7 through 7.1.3 unpack a full-package core update into a predictable folder under wp-content/upgrade/, and that staged copy includes the WordPress installer. A request that reaches the staged setup-config.php at the right moment can lead to PHP code execution with no account.

Wordfence deployed a firewall rule at 20:30 UTC on October 28 and logged more than 18,500 requests aimed at staged installer paths in the first 21 hours. Two of the biggest sources polled small groups of sites for about 14.5 hours. The Hacker News later reported 62,969 blocked attempts over 24 hours. Neither source reports a confirmed site takeover, and the bug is not on CISA’s exploited list.

Sites below 7.1.4 and sites still mid-update

Every site below 7.1.4, or below the fixed release for its branch, is in scope. The backports run from 7.0.8 and 6.9.11 down to 4.7.39. Sites on Wordfence Free do not get the blocking rule until November 27.

Rescana points out a catch: the update to 7.1.4 is itself unpacked by the old, unpatched code, so that last update can open the window once more. Wordfence also notes the attack requests the staged file directly without loading WordPress, so a plugin firewall that only runs inside WordPress will not see it unless Extended Protection is on.

Block the staging folder, then confirm 7.1.4 everywhere

• Deny web access to wp-content/upgrade/ in the server or virtual host config (or the site-root .htaccess) before the next core update runs, as Patchstack and Rescana advise.
• Confirm every site reports 7.1.4 or its branch backport under Dashboard, Updates, or with wp core version. Do not assume the background update landed.
• On sites using Wordfence, check that the firewall runs with Extended Protection.
• Read access logs from October 28 forward for PHP requests under wp-content/upgrade/, especially any that returned 200.

Details

• CVE: CVE-2026-119977, WordPress Core 4.7.0 to 7.1.3, unauthenticated upgrade-window staged-installer code execution. CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N), assigned by Wordfence, published October 31, 2026.
• Fixed: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14 and older branches down to 4.7.39 (Wordfence). WordPress rated the issue low in its own advisory, according to Rescana.
• Fix detail: 7.1.4 randomizes the staging folder name, adds an index guard and stops unsafe promotion of staged configuration data.
• Activity: 18,500+ requests in 21 hours (Wordfence); 62,969 blocked in 24 hours (The Hacker News). No confirmed compromise reported as of November 1.

Hunt / verify

• Search web server logs for requests containing wp-content/upgrade/ and setup-config.php; a 200 response is the one to chase.
• List administrators with wp user list --role=administrator and look for accounts nobody created.
• Compare plugins and PHP files against a clean copy, or run wp core verify-checksums, and look for PHP files created since October 28.

Source: Wordfence on CVE-2026-119977; WordPress 7.1.4 release

Sources

• Wordfence: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
• The Hacker News: WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
• Rescana: WordPress 7.1.4 Upgrade-Window Race RCE (CVE-2026-119977)
• Patchstack: WordPress 7.1.4 Security Release
• WordPress.org: WordPress 7.1.4
• CVE.org: CVE-2026-119977

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].