TLDR
- Wordfence blocked more than 240,000 attempts to exploit a WordPress flaw by November 6.
- The bug, CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3.
- CISA added it to its exploited vulnerabilities list and set a November 6 deadline for federal agencies.
- Sites can stay exposed while installing the very update that fixes the flaw.
- WordPress 7.1.4 fixes the issue, and Wordfence advises blocking PHP files in one folder first.
WordPress has a security flaw that attackers are targeting during the website update process. The flaw is tracked as CVE-2026-119977. It does not rely on weak passwords or old plugins.
⚠️ALERT: Hackers are now targeting WordPress, the software behind 39.5% of all websites online.
A critical flaw lets attackers take over a WordPress site in the seconds it spends updating, without needing to log in.
During a full update, WordPress briefly stages its installer… pic.twitter.com/vYPYviWSw7
— Coin Bureau (@coinbureau) November 6, 2026
Instead, it affects how WordPress handles certain full software upgrades. During these upgrades, WordPress briefly unpacks installation files into a folder that the public can reach. That short window is what attackers are trying to catch.
How the Attack Works
An attacker who reaches those files at the right moment may be able to run malicious PHP code. They would not need to log in to the site first. A successful attack could let them install backdoors or change website content.
They could also create unauthorized administrator accounts or steal sensitive information. The flaw has a CVSS severity score of 8.1 out of 10. That places it in the high-risk category.
Cybersecurity firm Wordfence says the flaw affects WordPress versions 4.7 through 7.1.3. That range covers nearly a decade of releases. WordPress runs about 39.5% of all websites worldwide, according to W3Techs.
Wordfence says attackers began targeting the flaw on October 28. That was the same day WordPress released its security update. Early monitoring found more than 18,500 suspicious requests in about 21 hours.
The numbers then grew. By November 6, the Wordfence firewall had blocked more than 240,000 exploitation attempts. The biggest day was October 30, with more than 74,000 malicious requests blocked.
Researchers also saw attackers probe sites repeatedly over long periods. They appear to be waiting for vulnerable sites to enter a brief update window. The blocked requests do not equal confirmed hacks.
Exploitation needs precise timing, which makes taking over a site harder than sending a request. Still, the volume shows strong interest from attackers.
Fix, Deadline and Advice for Site Owners
WordPress released version 7.1.4 on October 28. It fixes the flaw along with several other security issues. Patches are also available for older supported branches.
On November 3, the US Cybersecurity and Infrastructure Security Agency, known as CISA, added the flaw to its Known Exploited Vulnerabilities catalog. The agency gave federal civilian agencies until November 6 to fix it. CISA has confirmed the flaw is being actively exploited.
Researchers found a catch for sites that are still vulnerable. Because the old software handles the first step of the upgrade, a site can be exposed while it installs the fix. Wordfence advises blocking web access to PHP files in the /wp-content/upgrade/ directory before updating.
Wordfence has added firewall protection for its Premium, Care and Response customers. Users of the free plugin are set to get the same protection on November 27. Administrators are told to confirm the update finished, check server logs and review administrator accounts for changes.
Crypto businesses that run on WordPress face added risk, according to the reports. Exchanges, blockchain projects and crypto news sites could see website tampering or phishing links. The flaw does not directly affect blockchain networks or wallets. A hacked site could still trick visitors into connecting wallets or approving false transactions.
As of November 6, Wordfence had blocked more than 240,000 attempts, and administrators are being urged to install WordPress 7.1.4 and apply the available protections.
