WordPress vulnerability CVE-2026-119977: attackers strike during the update, here’s the right order
Keep WordPress up to date: it’s the first advice every site owner hears. This week, that advice comes with a warning. A WordPress vulnerability being exploited right now strikes during the update itself. If your site runs a version older than 7.1.4, the moment you click “Update” is exactly the moment attackers are waiting for.
On November 3, 2026, the U.S. agency CISA added CVE-2026-119977 (severity 8.1 out of 10) to its list of actively exploited vulnerabilities. WordPress fixed it on October 28 with version 7.1.4. Here’s what’s happening and, above all, in what order to act.
WordPress vulnerability CVE-2026-119977: a race of a few seconds
During a full WordPress core update, the new files are first unpacked into a temporary folder with a predictable name, wp-content/upgrade/. That folder includes the installation wizard setup-config.php, and it can be reached from the web. During that short moment, an attacker who calls it can restart the installation, connect the site to their own database and run code on your server. No account needed.
The attack window during a core update
The exact duration depends on the server. Attackers poll sites in a loop to hit this window.
Wordfence recorded more than 18,500 requests targeting these paths in the 21 hours after disclosure. According to its observations, some attackers poll the same site for hours, waiting for an update to start. It’s automated and it targets every site, not just large companies.
Are you affected? Versions to check
In your dashboard, the version appears at the bottom right or under Dashboard > Updates. Write it in the last column:
The right order: close the door, then update
Since the attack targets the update itself, you first block the temporary folder at the server level, then update. Here’s the procedure:
1. Block the temporary folder
Apache / .htaccess: RedirectMatch 403 ^/wp-content/upgrade/
Add this line to the .htaccess file at the site root (on Nginx, a location block that denies access to /wp-content/upgrade/). Test it: the address must answer “403 Forbidden”.
2. Back up
Files + database
Take a full backup before any change, and check that it opens.
3. Update
Dashboard > Updates > WordPress 7.1.4
Or from the command line: wp core update. Pick a time when you can stay in front of the screen.
4. Check integrity
wp core verify-checksums
The command compares your files with WordPress.org’s. Any modified or added file must be examined.
5. Keep the block
/wp-content/upgrade/ stays forbidden
This folder never needs to be visited from the web. Leave the rule in place for future updates.
If your site is with a managed host that runs updates for you, ask them in writing whether they’re already on 7.1.4 and whether they block this folder. We saw the same “flaw in the update tool” logic with the stolen UpdraftCentral keys.
Did someone try on your site?
// Spotting an attempt in the logs
How to read the result
- 1Look for any visit to wp-content/upgrade/. Normally, there are none.
- 2A GET that gets 404 or 403: blocked attempt or outside the window. Note it, don’t panic.
- 3A POST that gets 200 on setup-config.php: probable compromise. Isolate the site and call a specialist.
- 4After the update, every file flagged by verify-checksums must be explained.
Also check in wp-config.php that DB_HOST still points to your usual database server.
Frequently asked questions
Q1. Do WordPress automatic updates protect me?
They install the fix, but they also open the attack window, often at night. Blocking the temporary folder first is still best practice, even if your site updates itself.
Q2. I have a security plugin. Is that enough?
It depends on the plugin and the plan. Wordfence released a firewall rule for paying customers; the free version usually gets it about 30 days later. Check with your vendor rather than assuming.
Q3. My site is already on 7.1.4. Do I need to do anything else?
Yes: check the logs for the period between October 28 and your update, then run verify-checksums. If the update ran during an attack, the site could already be compromised.
Q4. Is this related to the PHP flaw you wrote about?
No, it’s a separate flaw specific to WordPress. But the lesson is the same as for the critical PHP vulnerability: a website needs the same care as a server.
How NeoTech can help
We can apply the block, the backup, the update and the integrity check for you, then review your logs since October 28. Our website design and maintenance services include scheduled, tested updates, and our automated 24/7 monitoring with on-call technician response spots modified files and suspicious requests on your sites and servers. For all your protections, see our cybersecurity services.
Book your free cyber check
In 30 minutes, we review together your WordPress version, your plugins, your backups and who really takes care of updates.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- CISA — CISA Adds One Known Exploited Vulnerability to Catalog, November 3, 2026
- The Hacker News — CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades, November 4, 2026
- Wordfence — WordPress 7.1.4 Security Release (remote code execution)
- WordPress.org — Version 7.1.4
Photo: Artem Podrez, Pexels (Pexels licence).