Attackers are conducting large-scale campaigns against WordPress sites by exploiting a vulnerability that surfaces during core updates and grants the attacker administrator privileges. Cybersecurity company Wordfence reports observing more than 240,000 attack attempts in just a few days.
The flaw, identified as CVE-2026-119977, affects sites performing full-package core updates. When the update package is extracted, new files—including the WordPress installer—are placed in a predictable directory that remains accessible from the internet. An attacker can invoke the installer, complete the installation process, and create a new administrator account, after which they can upload malicious PHP code and perform other unauthorized actions.
Although the attack window is narrow, threat actors have not been deterred. Wordfence first detected exploitation attempts on 29 October, shortly after the patch release, and activity has increased steadily since then.
To eliminate the risk, WordPress sites should update to WordPress 7.1.4. As an additional layer of protection, administrators can block PHP file execution in the /wp-content/upgrade/ directory at the web-server level.
The Dutch Nationaal Cyber Security Centrum has published its own advisory, stating that successful exploitation allows an attacker to take full control of the website, leading to data theft, content manipulation, or use of the site for malicious purposes. The agency confirms that the vulnerability is already being actively exploited in the wild.
