Attackers Exploit the WordPress Core TOCTOU Flaw During Upgrades

November 3, 2026. CISA adds CVE-2026-119977 to its KEV catalog of exploited vulnerabilities. October 28, 2026. WordPress ships 7.1.4, which fixes the flaw in core. October 30, 2026. The first bursts of requests targeting the staging paths are already showing up on firewalls. The story fits one line: during a core upgrade, an attacker can reach the temporary installer before it is cleaned up and point it at a database they control — opening a path to code execution on the server.

For a site operator, this is not a sophistication story. It is a story of timing and volume.

How the flaw works

CVE-2026-119977 is a TOCTOU (time-of-check, time-of-use) race condition, classified CWE-367, with a CVSS 8.1 score. The attack vector is unauthenticated and needs no user interaction, but it only fires at a precise moment: during a full core upgrade.

Here is the scenario. When WordPress deploys a full upgrade package, it extracts the files into a staging directory under wp-content/upgrade. On affected setups, that directory is web-accessible until the upgrade finishes. During that window — brief, but real — a copy of the WordPress installer is exposed publicly.

An attacker who reaches that installer before cleanup completes can use it to connect the staged install to a database they control. From there, server-side code execution is not far away. The whole game is to reach the temporary files before WordPress removes them — hence the race, and hence the attacker’s incentive to replay requests in a loop.

The scope is broad: WordPress Core 4.7 through 7.1.3 are affected. The 7.1.4 fix, released October 28, 2026, closes the window. The flaw was reported by researcher Umut Bayram, with Wordfence acting as CNA.

Why this flaw stands out

WordPress powers roughly 43% of the web — a volume that makes every core flaw an event, while plugin and theme flaws fill the ordinary run of security bulletins. This one has an extra trait: it does not live in a marginal feature but in the update mechanism itself.

The corollary is uncomfortable. Automatic updates — the very thing meant to fix this kind of problem — open the window the attacker needs. For as long as the package is extracted under wp-content/upgrade and then cleaned up, a copy of the installer is briefly reachable. That is the flaw’s paradox: the remedy creates the attack surface.

Two practical consequences follow. First, a patched site is not protected by good hygiene — the window opens precisely when it updates. Second, detection must focus on access logs and the contents of the upgrade directory, not just the version shown in the dashboard. The 7.1.4 fix closes the surface at the source: staging paths are no longer reachable during an upgrade, which is what separates a real fix from a firewall workaround.

What the exploitation numbers actually say

Active exploitation is real, but the numbers need to be read carefully — confusing blocked requests with compromised sites would distort your risk assessment.

First number: 18,500 requests. According to Cyber Security News, more than 18,500 requests targeted the staged installer paths within the first 21 hours of monitoring. Those requests alone do not prove a successful intrusion; they show the attack is automated and distributed.

Second number: 60,471 blocked attempts. A parallel tracking effort counted 60,471 blocked attempts over 24 hours. Wordfence separately cites 12,632 blocked attempts in 24 hours. All of these measure firewall activity, not the number of confirmed victims — two categories that must be kept separate when judging a campaign’s scale.

Third number: November 6, 2026. CISA set a November 6 remediation deadline for US federal civilian agencies under its binding directive BOD 26-04. That is the concrete translation of “prioritize this patch”: even without public proof of mass compromise, the known exploited status changes the priority order.

What to do now

The fix is simple; the verification is not. Here is the order of operations.

• Move to 7.1.4. Open Dashboard → Updates and confirm the security release has actually installed. Sites relying on automatic background updates still need that manual check.
• Cut web access to the upgrade directory. Restricting public access to wp-content/upgrade reduces exposure until the patch is applied. A firewall remains an extra layer, never a substitute for the fix.
• Audit the logs. Look for unusual requests to PHP files under wp-content/upgrade. That is the most reliable sign of an attempt targeting the upgrade window.
• Check accounts and files. Review administrator accounts, plugins, and recent file changes. An unfamiliar account or an unexplained plugin is a clue worth chasing.

Two commands are enough for a first triage on the server side:

# Requests that targeted the upgrade directory
grep -E "wp-content/upgrade" /var/log/nginx/access.log | awk '{print $1, $7}' | sort | uniq -c | sort -rn | head

# Files changed recently under the upgrade directory
find wp-content/upgrade -type f -mmin -1440 -ls

These are clues, not proof: a blocked request is not a compromise, but an unexpected leftover file deserves investigation.

WordPress has announced backports for eligible older branches, while noting that only the latest release remains actively supported. In plain terms: if you are still on a 4.x or 5.x branch, the real fix is a migration, not a security patch.

Verdict

The flaw is a race — hard to exploit by hand, but already automated at scale: 18,500 requests in 21 hours is enough to show the attacker will not wait for your maintenance window. The real risk is not the technique’s sophistication but the volume of attempts and the predictability of the staging path.

If you host WordPress, apply 7.1.4 before the week is out: it is a trivially deployable security fix, and the CISA deadline of November 6 already signals the urgency expected of teams. If you are on an old version, the patch alone is not enough — plan the upgrade, because the historical branches no longer have active support. Either way, treat every blocked request to wp-content/upgrade as a signal to investigate, not as proof that everything is fine.

References

• CISA — Known Exploited Vulnerabilities Catalog, CVE-2026-119977 (November 3, 2026)
• Cyber Security News — CISA Warns of WordPress Core Vulnerability Exploited in Attacks (November 4, 2026)
• The Hacker News — CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades (November 4, 2026)
• WordPress — Version 7.1.4 Security and Maintenance Release (October 28, 2026)
• CVE — CVE-2026-119977 (Wordfence, CNA)