WordPress Vulnerability Exploited in Over 240,000 Attacks During Core Updates
Attackers are actively exploiting a flaw in WordPress that appears during full-package core updates, allowing them to gain administrator access by completing an installation from a publicly accessible directory. Cybersecurity firm Wordfence has recorded more than 240,000 attack attempts within days of the issue becoming public. The vulnerability, tracked as CVE-2026-119977, was patched on 28 October 2026, yet exploitation began almost immediately and has continued to rise. During the update process, new files including the WordPress installer are extracted to a predictable, internet-accessible location, enabling attackers to finish the installation and create admin accounts. Sites running the latest version, WordPress 7.1.4, are protected, while additional server-level restrictions on PHP execution in the upgrade directory provide further mitigation. The Dutch NCSC has issued a separate advisory confirming active exploitation and warning of potential data theft and website takeover.
Security.NLNov 6, 2026Translated from NL