Threat actors have launched a massive, automated exploitation campaign targeting a newly disclosed Remote Code Execution (RCE) vulnerability in WordPress Core. Tracked as CVE-2026-119977 with a CVSS v3.1 score of 8.1 (High), the flaw affects an expansive range of deployments spanning WordPress Core versions 4.7 through 7.1.3.

According to real-time telemetry published by WordPress security provider Wordfence, security firewalls blocked 62,969 attack attempts targeting the vulnerability within a single 24-hour monitoring period, indicating widespread scanning by botnet operators seeking to hijack web hosting accounts during automated background updates.

Vulnerability Dissection: The Upgrade-Window Race Condition

When WordPress executes a full-package core update—either automatically or when initiated by a site administrator via the Dashboard—the update routine downloads the latest release archive, unpacks the files into a staging directory located at wp-content/upgrade/, verifies file checksums, and overwrites existing core binaries.

The security flaw resides in the handling of the temporary staging directory:

  1. Predictable Staging Paths: In affected versions, the temporary extraction folder utilized predictable naming conventions based on release hashes.
  2. Web-Accessible Staging Root: On many web server configurations (specifically standard NGINX or Apache virtual hosts lacking explicit deny rules for the wp-content/upgrade hierarchy), the temporary extraction directory was directly accessible over public HTTP requests.
  3. The Execution Gap: During the brief window (typically lasting between 2 and 10 seconds) while the archive was being uncompressed and before the update finalized, sensitive setup files—including wp-admin/setup-config.php—became live and executable under the temporary path.
// Attackers deployed automated continuous polling scripts:
GET /wp-content/upgrade/wordpress-core-temp/wp-admin/setup-config.php?step=1 HTTP/1.1
Host: target-website.com

// If the request landed during the exact seconds of an active background update,
// the unauthenticated setup wizard executed, allowing the adversary to bind the site
// to an external database and execute arbitrary PHP payloads!

The 63,000 Attack Surge

Because exploiting a race condition over a remote network requires high-precision timing, threat actors did not attempt single manual probes. Instead, adversaries deployed automated distributed scanning botnets that continuously polled high-traffic WordPress domains with HTTP HEAD and GET requests across known upgrade path variations.

As soon as an enterprise site triggered a routine security update, the adversary's automated probes detected the newly unpacked files, immediately issuing requests to complete setup routines and drop persistent web shells.

The Upstream Fix in WordPress 7.1.4

The WordPress security team released WordPress 7.1.4 alongside backported security patches for all major release branches dating back to 4.7. The update eliminates the vulnerability through three architectural defenses:

  • Cryptographically Random Directory Salts: Staging directories are now created using high-entropy random identifiers (e.g., wp-content/upgrade/core-a98f1c4e209b/), preventing attackers from guessing the active path.
  • Automated .htaccess & Index Guards: WordPress automatically writes access restriction files into the upgrade directory immediately upon folder creation, blocking direct web execution.
  • Atomic File Promotion: The file replacement process has been restructured to minimize the operational window during which staged files reside on disk before migration.

Actionable Verification for Site Administrators

All WordPress site owners and hosting providers should immediately verify their deployed core version:

# Check current core version via WP-CLI
wp core version

# If version is prior to 7.1.4, update immediately
wp core update

# Enforce web server block rules on wp-content/upgrade
# NGINX configuration snippet:
location ~* ^/wp-content/upgrade/ {
    deny all;
    return 403;
}