INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers Exploit WordPress Flaw Within 48 Hours of Security Patch

| 2026-11-03 13:25 CRITICAL HIGH EXPLOITED VULNERABILITY VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. The flaw sits in WordPress core itself, and it can let an attacker run code on a website while that site is installing an update.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-119977 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables 1 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
files 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-119977CVE-2026-119977
Target & Sectors
US
healthhealth
Incident Timeline
‎December 8
The next major release, WordPress 7.2, is scheduled for December 8.
infrastructure 7.2
The next major release, WordPress 7.2, is scheduled for December 8.
general_metric 7.2 WordPress
The next major release, WordPress 7.2, is scheduled for December 8.
‎2026/10/05
Patches for the flaw were released late last month.
‎October 28, 2026
Threat actors exploited a timing weakness in the update system of WordPress, which was patched on October 28, 2026.
industry Health
General Document Context
target_region United States
General Document Context
infrastructure 7.1.4
WordPress shipped version 7.1.4 on October 28, 2026, to close the hole.
infrastructure 4.7
Which Sites the WordPress Vulnerability Affects   The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable.
infrastructure 7.1.3
Which Sites the WordPress Vulnerability Affects   The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable.
infrastructure 7.0.8
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
infrastructure 6.9.11
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
infrastructure 6.8.12
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
infrastructure 5.9.20
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
organisation Wordfence
Security firm Wordfence said it blocked 62,969 attacks aimed at this vulnerability in WordPress over a single 24-hour period.
organisation GitHub
A GitHub security advisory published the next day described the issue as a timing weakness in the update system.
organisation WordPress Works
How the Vulnerability in WordPress Works   When WordPress performs a full-package core update, it first extracts the new files into a dedicated directory inside the upgrade folder.
organisation Umut Bayram
The advisory credits researcher Umut Bayram with discovering the flaw and reporting it responsibly.
‎October 28
Threat actors exploited the previously patched WordPress 7.1.4 vulnerability within 48 hours of its release on October 28.
infrastructure 7.1.4
What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability   Version 7.1.4, released on October 28, is mainly a security release.
organisation Fixes Beyond
What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability   Version 7.1.4, released on October 28, is mainly a security release.
‎2026/11/03
Threat actors have been attempting to exploit a high-severity security flaw in WordPress Core, tracked as CVE-2026-119977, within 48 hours of its release.
organisation WordPress
Attackers needed less than two days to start going after a freshly patched WordPress vulnerability.
During the first 21 hours after public disclosure, the WordPress security company said it recorded more than 18,500 requests targeting staged "setup-config.php" installer paths.
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours.
infrastructure 7.1.4
…lling and exact-layout probes show that attackers quickly understood the race condition and began targeting it." With active exploitation attempts already underway, WordPress site owners are advised to update to version 7.1.4 as soon as possible and look for suspicious requests to PHP files located under "wp-content/upgrade," as well as unfamiliar administrator accounts, plugins, or PHP files.
infrastructure 4.7
The vulnerability , which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3.
infrastructure 7.1.3
The vulnerability , which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3.
organisation CVSS
It carries a CVSS score of 8.1 on the CVSS scoring system.
organisation Hackers Exploit
Hackers Exploit WordPress Flaw
organisation Wordfence
Over the past 24 hours, Wordfence said it has blocked 62,969 attacks targeting the vulnerability.
organisation TOCTOU
The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers.
organisation Vulnerability / Web Security
 Ravie Lakshmanan  Oct 30, 2026 Vulnerability / Web Security Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.
organisation WordPress Core
 Ravie Lakshmanan  Oct 30, 2026 Vulnerability / Web Security Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.
organisation PHP
"Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution," Alex Thomas, who leads the Wordfence Threat Response Team, said.
organisation Wordfence Threat Response Team
"Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution," Alex Thomas, who leads the Wordfence Threat Response Team, said.
‎Nov 04, 2026
Threat actors exploited a previously patched security flaw in WordPress Core within 48 hours of its addition to the Known Exploited Vulnerabilities catalog.
industry Health
General Document Context
target_region United States
General Document Context
organisation Vulnerability / Web Security
 Ravie Lakshmanan  Nov 04, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation WordPress Core
 Ravie Lakshmanan  Nov 04, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation the Known Exploited
 Ravie Lakshmanan  Nov 04, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
tactic T1588.006 - Vulnerabilities
 Ravie Lakshmanan  Nov 04, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
Tactical Metrics
Metrics
infrastructure
‎7.1.4
Software Version
WordPress shipped version 7.1.4 on October 28, 2026, to close the hole.
What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability   Version 7.1.4, released on October 28, is mainly a security release.
…lling and exact-layout probes show that attackers quickly understood the race condition and began targeting it." With active exploitation attempts already underway, WordPress site owners are advised to update to version 7.1.4 as soon as possible and look for suspicious requests to PHP files located under "wp-content/upgrade," as well as unfamiliar administrator accounts, plugins, or PHP files.
Metrics
infrastructure
‎4.7
Software Version
Which Sites the WordPress Vulnerability Affects   The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable.
The vulnerability , which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3.
Metrics
infrastructure
‎7.1.3
Software Version
Which Sites the WordPress Vulnerability Affects   The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable.
The vulnerability , which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3.
Metrics
infrastructure
‎7.0.8
Software Version
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
Metrics
infrastructure
‎6.9.11
Software Version
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
Metrics
infrastructure
‎6.8.12
Software Version
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
Metrics
infrastructure
‎5.9.20
Software Version
It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.
Metrics
infrastructure
‎7.2
Software Version
The next major release, WordPress 7.2, is scheduled for December 8.
Intelligence Sources
The Hacker News 2026-10-30
The Hacker News 2026-11-04
The Cyber Express 2026-11-03