613/69 Friday, November 9, 2026
CISA has issued an alert regarding CVE-2026-119977, a vulnerability in the WordPress content management system that is being actively exploited to take control of websites. The flaw occurs during the WordPress core update process and officially affects WordPress versions 4.7 through 7.1.3, while deeper technical analysis indicates that versions as old as 2.7 may also be affected. Successful exploitation could allow an unauthenticated attacker to achieve Remote Code Execution (RCE) without requiring a valid user account on the target website.
The attack takes advantage of a time window during which WordPress extracts temporary installation files into the wp-content/upgrade/ directory before copying them into the live installation. If the server allows the directory to be accessed through the web, an attacker may reach the temporary installer files, supply database connection details under their control, and create a new wp-config.php file. When the update process continues, WordPress may overwrite the legitimate configuration file with the attacker-controlled version, causing the website to connect to the attacker’s database instead. This can allow the attacker to create a new administrator account and install plugins capable of executing malicious commands on the server. WordPress has released version 7.1.4, along with fixes for older supported branches, to address the vulnerability.
Administrators updating from a vulnerable WordPress version should take additional precautions because the older update mechanism may still expose temporary installation files during the first stage of the upgrade process. Before beginning the update, administrators should block external access to the wp-content/upgrade/ directory through server configuration or the site’s main .htaccess file and verify that requests to the directory return an HTTP 403 response. Another option is to manually download and replace WordPress core files outside the public web directory, which avoids exposing temporary installation files during the update process and reduces the risk of website takeover.
Source: https://hackread.com/cisa-hackers-exploiting-wordpress-core-vulnerability/