WordPress 7.1.4 released October 28, 2026; CVE record October 31, 2026; BtCIRT advisory November 2, 2026
WordPress Core Race in Its Own Update Window Drew 62,969 Attacks in 24 Hours: Update to 7.1.4
WordPress sites are being probed for a flaw in the update process itself. CVE-2026-119977, rated 8.1, affects WordPress Core versions 4.7 through 7.1.3: during a full-package core upgrade, WordPress staged the new files, including the installer, in a predictable and web-accessible directory under wp-content/upgrade. An unauthenticated attacker who repeatedly polls that path and reaches the staged setup-config.php during the brief window, which lasts only seconds in lab testing, can drive the installer toward remote code execution with the privileges of the web server process. Wordfence, acting as the CVE Numbering Authority for the record published October 31, reported 62,969 blocked exploitation attempts in the first 24 hours after the fix shipped, with two of the largest sources polling small groups of sites for about 14.5 hours to catch an upgrade in progress. No confirmed compromises have been established; the count is blocked attempts, not takeovers. WordPress fixed the flaw in version 7.1.4 on October 28, in a release that addresses 22 vulnerabilities, by randomizing the staging directory name, retaining an index.php guard and preventing unsafe configuration files from being promoted. The issue was reported by Umut Bayram. Because the malicious request reaches a PHP file without loading WordPress, a security plugin may never see it, so web server logs and file checks are the reliable evidence.
Executives
The uncomfortable detail is timing: the attack targets the moment a site updates, which is the moment owners believe they are making it safer, and automatic updates mean that window opens on a schedule attackers can wait for. WordPress powers a large share of business and storefront sites, including payment pages where PCI DSS duties apply. The ask is simple: confirm every self-hosted site is on 7.1.4 or a backported fix, and that someone checked the server logs, not only the plugin dashboard.
CIO / CISO
Sequence the fix the way BtCIRT recommends: deny web access to wp-content/upgrade at the web server first, then update, because updating from 7.1.3 itself runs the vulnerable upgrader. Review access logs for bursts of requests to setup-config.php and other paths under wp-content/upgrade, check that folder for stray PHP files, and look for new administrator accounts or modified core files. Keep automatic updates on once the fixed version is in place, since the fix removes the exposure future upgrades carried.
Engineers
Check the version with the dashboard Updates screen or wp core version, and verify the running build after updating rather than trusting the update notice. Add the server-level deny rule for the upgrade directory and disable PHP execution there where your stack allows it. Remember the evidence point: the exploit request bypasses WordPress entirely, so plugin logs are the wrong place to hunt; use web server access logs and file integrity checks.
Everyone (non-IT)
If you run a WordPress site, update it today under Dashboard, Updates, and leave automatic updates turned on. If your site is on managed hosting, ask your provider to confirm 7.1.4 or the backport for your branch has been applied. You do not need to change passwords or warn your visitors unless your provider or IT contact finds signs of compromise.