A race condition in the WordPress update process is under attack, CISA confirms. Here is who is exposed, what the fix changes and what to check.
A WordPress Core flaw tracked as CVE-2026-119977 is being exploited, and CISA has added it to its list of actively attacked bugs. It affects WordPress versions 4.7 through 7.1.3. WordPress 7.1.4, released October 28, fixes it, and older branches are receiving backported patches.
The bug strikes during updates. While WordPress unpacks a full Core package, it stores the new files, including the installer, in a predictable folder that many servers expose to the web. An attacker who hits that folder at the right second can run code on the server without logging in. Wordfence blocked 62,969 attempts in one day, with some attackers polling sites for hours to catch an update in progress.
The WordPress vulnerability today that matters most hides inside the one thing site owners are told to do: updating. CVE-2026-119977 is a race condition in WordPress Core that lets an attacker with no account run code on your server during the few seconds a full Core update is being unpacked, and the US Cybersecurity and Infrastructure Security Agency (CISA) has now confirmed hackers are using it.
Here is the short answer. Every WordPress version from 4.7 through 7.1.3 is affected, and WordPress 7.1.4, released on October 28, 2026, fixes it. If your dashboard shows 7.1.4, or your older branch has received its backported security update, you are covered. If not, update now, then check for the warning signs listed below.
The flaw reaches back nearly a decade of releases, covering WordPress Core 4.7 through 7.1.3. The fix arrived in WordPress 7.1.4, a security release that patched 22 issues in total, and the WordPress team says it has backported the fixes to every branch still eligible for security updates, which currently means back to 4.7.
There is a catch in that backport promise. WordPress says the older-branch patches are shipping as they become ready, and it reminds owners that only the newest version is actively supported. If you run an old branch on purpose, confirm that your branch has actually received a new release since late October rather than assuming it has.
The attack works by catching WordPress mid-update. When an affected site installs a complete Core package, it unpacks the new files, including the WordPress installer, into a staging folder under wp-content/upgrade whose location is predictable. On many servers that folder can be reached from the web.
If an attacker requests the staged installer page, setup-config.php, at exactly the right moment, they can interact with that half-installed copy of WordPress and work their way to running PHP code on the server. Code execution on the server is the worst kind of web bug, because it can lead to stolen data or a full takeover of the site.
Wordfence, the WordPress security company that published the technical details, lists four things that have to line up for the attack to succeed:
In lab tests that window lasted only seconds, which is why the bug is rated high rather than critical. But attackers have a simple answer to a short window: keep knocking.
Attackers started probing within hours of the patch going public. Wordfence says the first hit on its new firewall rule came nine minutes after the rule went live, and it logged more than 18,500 requests aimed at staged setup-config.php paths in the first 21 hours.
The volume then jumped. Over one 24-hour stretch the company blocked 62,969 attacks against the flaw, and two of the busiest sources kept hammering small groups of sites for roughly 14.5 hours, exactly the behavior you would expect from someone waiting for an update to start. More recently it reported 12,632 blocked attempts in a day. Separately, the security firm Previdian saw three exploitation attempts against its honeypot sensors on October 30, 2026, from an address located in the UK.
That is what pushed CISA to add CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3. The listing gives US federal civilian agencies until November 6, 2026 to patch, a three-day deadline. Private site owners are not bound by it, but CISA only adds bugs to that list when it has evidence of real attacks. Wordfence has not reported any successful compromises so far.
If you run a blog, a shop or a club website on WordPress, the risk is real but easy to remove. Sites that accept automatic background updates should already have pulled in 7.1.4 on their own, according to WordPress. The sites most at risk are the ones nobody looks after: an old installation where automatic updates were switched off, or a site a freelancer built years ago and never touched again.
Your hosting also matters. The attack needs the staging folder to be reachable from the web with PHP running there. Some servers allow that and some don’t, and most owners have no easy way to tell which kind they are on. Treat your site as exposed until it is patched.
There is one open question no official source has answered. Installing 7.1.4 is itself a full Core update, so the upgrade to the fixed version runs through the same kind of window the bug abuses. Nobody has said whether the fix protects that very first run. That doesn’t change the advice to update, because staying on an affected version leaves the door open every time an update happens.
These steps come from WordPress’s release notes and the guidance Wordfence and CISA gave with the warning:
Once you are on 7.1.4 the hole is closed for good. The fix makes WordPress pick a random staging folder name, adds a guard file so the folder can’t be listed, and stops staged configuration data from being promoted unsafely.
It is CVE-2026-119977, a race condition in the WordPress Core update process that can let an attacker with no login run code on the server while a full update is being unpacked. CISA says it is being exploited.
Yes. WordPress 7.1.4 fixes this flaw along with a long list of other security issues, mostly stored cross-site scripting bugs. The next major release, WordPress 7.2, is planned for December 8.
Probably not, since sites with automatic background updates should receive 7.1.4 on their own. Still, open the Updates screen to confirm the version and scan for unfamiliar admin accounts or plugins.
You're reading the quick version.
Read next
Polymarket hacked: is your money safe, and who gets refunded?
A swapped page-speed script drained 726 wallets in under an hour. Here's what happened, who is being paid back, and how to protect your account.
Freezers in stores across Europe were switched to defrost or pushed to 50C, and now UK meat suppliers say they were caught in the same wave.
The backdoor was put there at the factory, survives restarts and can't be removed by owners. Here's how to tell if your cheap streaming box is at risk.
Pentagon investigators now treat the August outages at military grocery stores as a suspected cyberattack. Here's what's confirmed, what isn't, and why.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
