WordPress Core RCE Vulnerability Hits Core Updates
A WordPress core RCE vulnerability can be triggered while a site updates itself: during a full core upgrade, the new files sit for a short time in a predictable folder that anyone can request. Wordfence assigned it CVE-2026-119977 (CVSS 8.1), and CISA added it to the Known Exploited Vulnerabilities catalog on November 3 with a federal deadline of November 6. WordPress 7.1.4, released on October 28, fixes it.
What Happened in the WordPress Core RCE Vulnerability
The WordPress core RCE vulnerability sits in the full-package update process. WordPress extracted the new files to a predictable directory inside the web-served upgrade folder. An unauthenticated attacker who wins a race against that extraction can execute code on the server. The WordPress security advisory (published October 29) lists WordPress 4.7 through 7.1.3 as affected. Umut Bayram of Picus Security reported it.
WordPress released 7.1.4 on October 28, and sites with background updates start the update on their own. The release post says fixes for older branches ship as they become ready; Wordfence lists patched versions for every branch from 4.7.39 up, including 6.8.12, 6.9.11 and 7.0.8. As of November 4, the WordPress release page shows only 7.1.4 for this fix, so confirm that the release for your branch is available before you rely on it. The two ratings differ: the WordPress advisory marks the issue Low, while Wordfence scores it 8.1 with high attack complexity, because the attacker has to hit the window.
CISA lists the flaw as exploited and calls for forensic triage. As of November 4, CISA marks ransomware use as unknown, and we found no named actor. The Hacker News reports, citing Wordfence, more than 18,500 requests aimed at staged setup-config.php installer paths in the first 21 hours after disclosure.
Why It Matters
The exposure is short but it comes back with every full core update. Attackers need no plugin bug and no login, only timing, and the requests Wordfence counted show that they are already probing for the staged path. Assumption: agencies and hosts that update many sites at once open that window most often.
For a company site this means a possible takeover of the web server account, with the usual follow-on risks: defacement, malware delivery to visitors, stolen form data. If personal data is involved, GDPR reporting duties may apply, and NIS2-covered organisations should check their own thresholds. In July we covered wp2shell, a flaw in the REST API; this one is in the update process itself.
What You Should Do Now
- Check the version of every WordPress site and update to 7.1.4, or to the fixed release for your branch once it is available (listed as 7.0.8, 6.9.11 or 6.8.12). WordPress backports security fixes only as far back as 4.7, so older sites need a larger upgrade.
- Do not assume auto-updates have run. Confirm the version site by site, including sites managed by an agency or host.
- Look for signs of abuse since October 28: web server logs for requests to staged setup-config.php installer paths, unknown PHP files, new administrator accounts, and modified core files (
wp core verify-checksumscompares core files with the official release). - Ask your host or agency how upgrade folders are protected while an update runs. We found no vendor guidance on this, so treat it as a question to them, not a fix.
DIESEC Perspective
We treat the CMS update itself as a change to monitor: who ran it, when, and what appeared in the web root afterwards. Few sites log that, and it is the evidence you will want if a window like this was used.
Not sure whether your WordPress sites were updated safely? Contact DIESEC for a WordPress patch verification and compromise check.
Sources: WordPress 7.1.4 release | WordPress security advisory | Wordfence | CISA | The Hacker News
Published: 2026-11-05 | Category: Vulnerabilities & Patches | ~4 min read
