Attackers target WordPress core flaw that lets them run code during updates
- Affected
- Every release from
4.7.0through7.1.3before its branch’s security release, the CVE record says. All versions and fixes
- Vendor
- WordPress
A race condition in WordPress core, , lets an unauthenticated attacker run code on the server in the brief window while a site unpacks a full core update. Wordfence recorded more than 18,500 requests aimed at it in the 21 hours after its firewall rule went live on Oct 28, the day WordPress fixed it. CISA added the flaw to KEV on Nov 3.
During a core update that uses a complete WordPress package, affected versions unpack the new files into a predictable folder under wp-content/upgrade, Wordfence says. That staged copy includes the WordPress installer, and on many servers the folder can be reached from the web. An attacker who requests the installer at the right moment can work through the staged copy to run PHP code. In Wordfence’s lab tests the folder lasted only seconds, so one request is unlikely to succeed, but repeated polling improves the odds.
Wordfence’s firewall rule went live at 4:30 p.m. ET on Oct 28, about three hours after the release, and caught its first request nine minutes later. Two of the largest sources of requests polled small groups of sites for about 14.5 hours, which Wordfence calls consistent with trying to catch the upgrade window. Others tried many variations of folder and version names. Not every request used the exact vulnerable path, and Wordfence doesn’t say whether any attempt succeeded. On Nov 4, its database page said it had blocked 12,391 attacks on the flaw in the past 24 hours.
The CVE record, which Wordfence published on Oct 31, lists every branch from 4.7 through 7.1 as affected until its security release. Wordfence rates the flaw 8.1 under CVSS 3.1, with high attack complexity. An attacker needs a full-package update, web access to the staging folder, its path and enough time before WordPress cleans it up. WordPress 4.6 and earlier get no security updates.
WordPress 7.1.4 randomizes the staging folder, adds an index guard and stops unsafe promotion of staged configuration data, Wordfence says. The release fixes 22 flaws in all, and many of the rest need a logged-in Contributor, Author or Editor account, Wordfence says. Wordfence Premium, Care and Response customers got the firewall rule on Oct 28, and Wordfence Free users get it on Nov 27. Wordfence says the rule doesn’t replace the update.
- Vendor
- WordPress
What to do
5 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| WordPress 7.1 | 7.1.0 through 7.1.3 | 7.1.4 or later |
| WordPress 7.0 | 7.0.0 through 7.0.7 | 7.0.8 or later |
| WordPress 6.9 | 6.9.0 through 6.9.10 | 6.9.11 or later |
| WordPress 6.8 | 6.8.0 through 6.8.11 | 6.8.12 or later |
| WordPress 6.7 | 6.7.0 through 6.7.10 | 6.7.11 or later |
| WordPress 6.6 | 6.6.0 through 6.6.10 | 6.6.11 or later |
| WordPress 6.5 | 6.5.0 through 6.5.13 | 6.5.14 or later |
| WordPress 6.4 | 6.4.0 through 6.4.13 | 6.4.14 or later |
| WordPress 6.3 | 6.3.0 through 6.3.13 | 6.3.14 or later |
| WordPress 6.2 | 6.2.0 through 6.2.14 | 6.2.15 or later |
| WordPress 6.1 | 6.1.0 through 6.1.15 | 6.1.16 or later |
| WordPress 6.0 | 6.0.0 through 6.0.17 | 6.0.18 or later |
| WordPress 5.9 | 5.9.0 through 5.9.19 | 5.9.20 or later |
| WordPress 5.8 | 5.8.0 through 5.8.18 | 5.8.19 or later |
| WordPress 5.7 | 5.7.0 through 5.7.20 | 5.7.21 or later |
| WordPress 5.6 | 5.6.0 through 5.6.22 | 5.6.23 or later |
| WordPress 5.5 | 5.5.0 through 5.5.23 | 5.5.24 or later |
| WordPress 5.4 | 5.4.0 through 5.4.24 | 5.4.25 or later |
| WordPress 5.3 | 5.3.0 through 5.3.26 | 5.3.27 or later |
| WordPress 5.2 | 5.2.0 through 5.2.29 | 5.2.30 or later |
| WordPress 5.1 | 5.1.0 through 5.1.27 | 5.1.28 or later |
| WordPress 5.0 | 5.0.0 through 5.0.30 | 5.0.31 or later |
| WordPress 4.9 | 4.9.0 through 4.9.34 | 4.9.35 or later |
| WordPress 4.8 | 4.8.0 through 4.8.33 | 4.8.34 or later |
| WordPress 4.7 | 4.7.0 through 4.7.38 | 4.7.39 or later |
- Product
- WordPress 7.1
- Affected
7.1.0through7.1.3- Fixed
7.1.4or later
- Product
- WordPress 7.0
- Affected
7.0.0through7.0.7- Fixed
7.0.8or later
- Product
- WordPress 6.9
- Affected
6.9.0through6.9.10- Fixed
6.9.11or later
- Product
- WordPress 6.8
- Affected
6.8.0through6.8.11- Fixed
6.8.12or later
- Product
- WordPress 6.7
- Affected
6.7.0through6.7.10- Fixed
6.7.11or later
- Product
- WordPress 6.6
- Affected
6.6.0through6.6.10- Fixed
6.6.11or later
- Product
- WordPress 6.5
- Affected
6.5.0through6.5.13- Fixed
6.5.14or later
- Product
- WordPress 6.4
- Affected
6.4.0through6.4.13- Fixed
6.4.14or later
- Product
- WordPress 6.3
- Affected
6.3.0through6.3.13- Fixed
6.3.14or later
- Product
- WordPress 6.2
- Affected
6.2.0through6.2.14- Fixed
6.2.15or later
- Product
- WordPress 6.1
- Affected
6.1.0through6.1.15- Fixed
6.1.16or later
- Product
- WordPress 6.0
- Affected
6.0.0through6.0.17- Fixed
6.0.18or later
- Product
- WordPress 5.9
- Affected
5.9.0through5.9.19- Fixed
5.9.20or later
- Product
- WordPress 5.8
- Affected
5.8.0through5.8.18- Fixed
5.8.19or later
- Product
- WordPress 5.7
- Affected
5.7.0through5.7.20- Fixed
5.7.21or later
- Product
- WordPress 5.6
- Affected
5.6.0through5.6.22- Fixed
5.6.23or later
- Product
- WordPress 5.5
- Affected
5.5.0through5.5.23- Fixed
5.5.24or later
- Product
- WordPress 5.4
- Affected
5.4.0through5.4.24- Fixed
5.4.25or later
- Product
- WordPress 5.3
- Affected
5.3.0through5.3.26- Fixed
5.3.27or later
- Product
- WordPress 5.2
- Affected
5.2.0through5.2.29- Fixed
5.2.30or later
- Product
- WordPress 5.1
- Affected
5.1.0through5.1.27- Fixed
5.1.28or later
- Product
- WordPress 5.0
- Affected
5.0.0through5.0.30- Fixed
5.0.31or later
- Product
- WordPress 4.9
- Affected
4.9.0through4.9.34- Fixed
4.9.35or later
- Product
- WordPress 4.8
- Affected
4.8.0through4.8.33- Fixed
4.8.34or later
- Product
- WordPress 4.7
- Affected
4.7.0through4.7.38- Fixed
4.7.39or later
Timeline
- Oct 28WordPress releases
7.1.4and security releases for older branches back to4.7. - Oct 28Wordfence’s firewall rule goes live at 4:30 p.m. ET and catches its first request nine minutes later.
- Oct 29Wordfence reports that attackers are trying to exploit the flaw.
- Oct 31Wordfence publishes the CVE record for .
- Nov 3CISA adds the flaw to KEV.
Sources
- Wordfence researchPrimary source wordfence.com
- WordPress release notesPrimary source wordpress.org
- WordPress noticePrimary source wordpress.org
- Wordfence vulnerability databasePrimary source wordfence.com
- CISA KEV catalog CVE-2026-119977Primary source cisa.gov