Hackers are waiting for your WordPress site to update so they can slip in

Nine minutes. That is how long it took, according to security vendor Wordfence, for its firewall to detect a first attack attempt after deploying the rule that protects against the new WordPress flaw. The software, which powers a large share of websites, released version 7.1.4 on October 28, fixing 22 security vulnerabilities. One of them is already attracting hackers.

It affects all versions from 4.7 to 7.1.3. According to Wordfence, which credits researcher Umut Bayram with the discovery, it is a "race condition" in the WordPress core update process. Exploited without an account, it could allow code to be executed on the server. Its severity score is 8.1 out of 10, and Wordfence assigned it the identifier CVE-2026-119977, published on October 31.

A window of a few seconds during the update

The paradox lies in the mechanism. During a full update, WordPress unpacks its files into a working folder with a predictable name, under wp-content/upgrade, including its installation program. If the server leaves that folder accessible from the internet and allows PHP to run, an attacker who calls that program at the right moment could take control of it, according to the analysis reported by GBHackers.

The moment is brief: in the lab, the window lasts only a few seconds, and Defiant, the company behind Wordfence, considers the attack complex. Hackers make up for it by persisting. They repeatedly probe the vulnerable paths, notably setup-config.php, hoping to catch a site in the middle of an update. Wordfence recorded more than 18,500 such requests in the first 21 hours.

These figures describe attempts, not successful hacks: at this stage, Wordfence has not reported any compromise.

What should you do?

The flaw sits in the update itself, which is also the only real remedy:

• Check your version under Dashboard, then Updates: you need 7.1.4, or the patched version of your branch if you stay on an older branch. Do not assume the automatic update went through.
• Block PHP execution in upload and update folders if your hosting allows it.
• Wordfence users: paying customers have been protected since October 28 at 8:30 p.m. UTC. Free-version users will not receive the rule until November 27. Wordfence advises enabling its "extended protection," because the attack calls PHP files directly without going through WordPress.
• Check your logs: look for unexpected PHP requests under wp-content/upgrade, administrator accounts or plugins you do not recognize, and run a file scan.

A firewall is no substitute for the patch, and its silence does not prove a site has not been visited.

Forgotten sites, the likeliest first targets

WordPress remains a prime target, as the recent case of the keys stolen from the publisher of the UpdraftPlus plugin showed. This time, the most exposed will probably be sites no one watches anymore: nonprofit showcase sites, sites for past events, forgotten staging environments. We will need to watch for the first report of a successful compromise.

Update of November 13, 2026

The WordPress flaw lodged in the update process, CVE-2026-119977, is now officially exploited by hackers. On November 3, the US cybersecurity agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, BleepingComputer reports. US federal agencies had until November 6 to patch. That deadline does not apply to businesses, but CISA urges all defenders to treat the flaw as a priority.

CISA does not detail these attacks. In an update to its bulletin published the weekend of October 31, Wordfence says it blocked 13,095 attacks targeting this flaw in 24 hours: these are blocked attempts, not successful hacks. BleepingComputer reports no confirmed compromise. The advice does not change: install WordPress 7.1.4, released on October 28 (or, on an older branch, its patched version, such as 7.0.8 or 6.9.11), and check that the update was actually applied.