Hackers Launch 240,000 Exploit Attempts WordPress Core Flaw Enabling Remote Code Execution

Hackers have launched more than 240,000 exploit attempts against a WordPress Core vulnerability that can allow attackers to run malicious code without logging in. According to the supplied Wordfence report, attacks began on October 28, 2026, the same day WordPress released a security update addressing the flaw.

Tracked as CVE-2026-119977, the vulnerability carries a high severity CVSS score of 8.1. It affects unpatched WordPress branches from 4.7 through 7.1.3. Researcher Umut Bayram reported the weakness, which involves predictable, publicly accessible folders created during full WordPress Core upgrades.

WordPress addressed the issue in its October 28 security release, alongside several other security fixes. Older branches also received backported patches. Cybersecuritynews.com’s earlier coverage of WordPress 7.1.4 security fixes explained how the update changes temporary folder handling to reduce exposure during upgrades.

240,000 WordPress Exploit Attempts

During a full upgrade, WordPress extracts installation files into a temporary folder beneath /wp-content/upgrade/. On vulnerable installations, predictable folder names can let attackers find this separate installer through a web request while the update remains in progress. No existing WordPress account or user interaction is required.

The attack depends on a race condition, meaning the attacker must reach those files at the right moment. The temporary installer must remain accessible long enough to complete the attack before cleanup removes it. This timing requirement makes successful exploitation difficult, even when attackers repeatedly probe known paths.

The official WordPress release announcement confirms that the upgrade weakness can lead to remote code execution. The CVE record classifies it as a time-of-check, time-of-use race condition, with high potential impact on data confidentiality, integrity, and availability.

According to the supplied Wordfence analysis, attackers reaching the exposed installer could complete a staged installation, create an administrator account, and upload malicious PHP code. That access could support backdoors, content changes, or data theft. Observed requests targeted installer files inside predictable upgrade directories.

Wordfence’s supplied figures show attack traffic peaked on October 30, when its firewall blocked more than 74,000 requests. Activity was highest between October 29 and November 1. These figures describe blocked requests, not confirmed infections, successful code execution, or the number of individual websites affected.

Earlier reporting on 60,000 WordPress attack attempts made the same distinction. Repeated automated requests can increase the chance of finding an exposed installer, but request totals alone cannot establish whether attackers completed the required steps or gained lasting access.

Administrators should install WordPress 7.1.4 or the corresponding patched release for their branch. Automatic background updates may have installed the fix, but owners should verify completion. WordPress recommends immediate updating and notes that only its latest release receives active support.

Updating from a vulnerable version still uses its existing upgrade process once. The supplied Wordfence guidance recommends blocking public access to PHP files beneath /wp-content/upgrade/ before updating. Its protection requires Extended Protection mode because staged PHP files run outside normal WordPress loading.

Indicators of Compromise

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.