WordPress Rated Its Own Core Update Race Condition Low. Wordfence Blocked 62,969 Attacks on It in a Day, and CISA Gave Agencies Until November 6 to Patch.
If you run WordPress, update to 7.1.4, or to the patched release for your branch, today. Every version from 4.7 through 7.1.3 is affected. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3 as CVE-2026-119977, with a federal due date of November 6.
The part worth knowing is the disagreement over how serious it is. WordPress's own security advisory, published October 29, says "No known CVE" and rates it Low. Coverage of Wordfence's research and CISA's catalog treat it as a high-severity code execution bug under active attack. We think both can be honest about what they measured, and the difference matters for how fast you move.
What the bug is
Per WordPress's advisory, when a site runs a core update that uses a complete package, WordPress extracts the new files to a predictable directory inside the web-served upgrade folder. An unauthenticated attacker who wins a race against that extraction can reach remote code execution. Wordfence says that directory is under wp-content/upgrade, that the copy includes the WordPress installer, and that on many servers the directory can be reached from the web. In its lab tests the window lasted only seconds.
No login is needed. The attacker has to be asking at the right moment, which is why what you see in the logs is repeated polling and not a single clever request.
Why the severity disagrees
WordPress's advisory rates it Low. The coverage we read gives it a CVSS score of 8.1 and calls it high severity, without saying who scored it. CISA lists it as exploited. Our reading, which is ours and not any of theirs: Low is a statement about how narrow the window is on any one site on any one update. High is a statement about what happens when attackers poll thousands of sites continuously and a core update happens somewhere every minute. Both can be true. The second is the one that decides your risk.
The advisory says the fix was also backported as a courtesy to every branch back to 4.7. That is the project treating it as worth patching everywhere, whatever the label says.
What the exploitation numbers say
Source | Figure | As reported |
Wordfence | 62,969 attacks blocked in 24 hours | The Hacker News, October 30 |
Wordfence | More than 18,500 requests for staged installer paths such as setup-config.php in the first 21 hours after public disclosure | The Hacker News, November 4 |
Wordfence | 12,632 exploit attempts blocked in the previous 24 hours | The Hacker News, November 4 |
Previdian | Three attempts against its honeypot from a U.K.-geolocated address, observed October 30 | The Hacker News, November 4 |
These are vendor counts from their own customers' traffic. They are not comparable to each other and they are not a count of compromised sites. We have not seen a count of sites that were actually taken over.
What to do
Update. The patched releases are 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34 and 4.7.39. Use the one that matches your branch.
Then look. Wordfence's advice is to search your logs for suspicious requests to PHP files under wp-content/upgrade, and to check for administrator accounts, plugins or PHP files you do not recognize. If your site ran a core update in the last week and you see either, treat it as compromised until shown otherwise.
We could not find, in the advisory or the coverage, whether automatic background core updates are affected differently from manual ones. If you rely on automatic updates, confirm your site is actually on a patched version and do not assume it is.
What we hold
CISA's catalog entry for CVE-2026-119977 is in our own copy of the Known Exploited Vulnerabilities catalog, dated November 3. There are no indicators of compromise in any source we read beyond the installer path name, so there is nothing to ingest into the feed, and we have not checked our own edge for requests to that path. This is a patch story. We read the same advisories everyone else did.
Limits
We read WordPress's advisory, The Hacker News's coverage of Wordfence's work and CISA's catalog entry. We could not read Wordfence's own page, which came back empty when we fetched it, so the Wordfence figures here are as The Hacker News reports them. The coverage says no CVE existed on October 30 and CISA used one on November 3. We do not know which party assigned it or when.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments