Affected Systems

WordPress versions 4.7 through 7.1.3. Fixed in version 7.1.4 and corresponding patches for older branches back to 4.7. WordPress 4.6 and earlier are end-of-life and remain vulnerable. Sites running 5.9 or later face predictable temporary folder names during update, increasing risk. Complete package updates always expose the installer; partial updates may not.

Exploitation Status

Actively exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. Wordfence observed attack attempts starting 9 minutes after firewall rule deployment, with sustained campaigns targeting the update window for ~14.5 hours. Public exploit code available on GitHub since this week.

Business Impact

Unauthenticated attackers can execute arbitrary PHP code with web server permissions during the brief window when WordPress unpacks update files. The vulnerability allows attackers to write malicious wp-config.php files, set up rogue databases, and read/write files in the live WordPress installation. The patching process itself creates a final exploitation window because updates unpack using old, vulnerable code. CVSS score 8.1 (High). Wordfence lab tests show the window lasts only seconds, but automated attacks are actively scanning for it.

Urgency

🔴 Immediate

Recommended Actions

  • Block web access to /wp-content/upgrade/ immediately before patching. On Nginx add 'location ^~ /wp-content/upgrade/ { deny all; }' to server config. On Apache add 'Require all denied' in Directory block or 'RedirectMatch 403 ^/wp-content/upgrade/' in root .htaccess above WordPress rewrite rules. Verify 403 response.
  • Update all WordPress installations to version 7.1.4 or the corresponding patched release for your branch (fixes available back to 4.7). Prioritize internet-facing sites running versions 5.9 through 7.1.3 due to predictable folder naming.
  • For high-value sites, perform manual updates outside the web root: back up files and database, unpack new release in non-served directory, copy core files without touching wp-config.php or wp-content, then run database update via browser.
  • Audit WordPress sites for indicators of compromise: check for unexpected wp-config.php modifications, review web server logs for requests to /wp-content/upgrade/ paths (especially install.php or wp-admin/install.php), and inspect for unauthorized PHP files or database connections.
  • Migrate WordPress 4.6 and earlier installations to supported versions immediately—no patches exist for end-of-life releases vulnerable since 2008.