CVE-2026-119977, a flaw in WordPress core, is now being used in real attacks. On November 3, the US cybersecurity agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog. It affects every WordPress version from 4.7 to 7.1.3 and carries a CVSS score of 8.1.
The problem appears when core is updated with a full package. WordPress unpacks the new version into the wp-content/upgrade/ folder, and while it does, the installer files there stay reachable from a browser. An attacker without an account who catches that window of a few seconds can run their own code on the server. The window is short, but attackers poll sites over and over for hours: in the first 21 hours after Wordfence switched on its protection rule, it logged more than 18,500 requests to these paths.
The fix arrived on October 28 with WordPress 7.1.4, and older branches have their own releases going back to 4.7.39. So the first job is to check the version: wp core version, then wp core update --minor if needed, followed by wp core verify-checksums. Don't assume automatic updates did the work, check each site.
If one server hosts several sites, it is convenient to add protection at the web server level: blocking web access to wp-content/upgrade/ in nginx or Apache covers every site at once. Firewall plugins running inside WordPress don't help here, because the copy unpacked during the attack runs its own files. This lowers the risk, but it doesn't replace the update.
If a site was updated in recent days, it is worth checking the logs for requests to PHP files under wp-content/upgrade/, unknown administrator accounts and plugins nobody installed.
Sources: The Hacker News, Webhosting Today.
