Hackers Attempt 240,000 Exploits Targeting WordPress Core Vulnerability That Allows Remote Code Execution

Cybercriminals have initiated over 240,000 exploit attempts targeting a critical vulnerability in WordPress Core, which enables perpetrators to execute malicious code without the necessity of authentication.

A report from Wordfence indicates that these assaults commenced on October 28, 2026, coinciding with the day WordPress issued a security update to rectify this flaw.

Designated as CVE-2026-119977, this vulnerability is rated with a high severity CVSS score of 8.1. It impacts unpatched WordPress versions ranging from 4.7 to 7.1.3.

Researcher Umut Bayram has highlighted that the weakness stems from predictable, publicly accessible directories generated during comprehensive WordPress Core upgrades.

WordPress rectified the issue in its security release on October 28, alongside several additional security enhancements. Legacy versions also received backported patches.

Earlier coverage by Cybersecuritynews.com regarding the security updates in WordPress 7.1.4 elaborated on modifications made to the handling of temporary folders, thereby mitigating risks during upgrades.

240,000 WordPress Exploit Attempts

In the course of a full upgrade, WordPress unpacks installation files into a temporary directory situated under /wp-content/upgrade/.

For susceptible installations, predictable directory names allow attackers to locate this installer through web requests while the update is still in progress. Importantly, no existing WordPress account or user intervention is required for this breach.

This exploit relies on a race condition, necessitating the attacker to access the files at an opportune moment. The temporary installer must remain accessible long enough for the assailant to execute their attack before its subsequent elimination.

While the timing intricacies render successful exploitation challenging, repeated probing of known paths increases the likelihood of achieving their objectives.

The official WordPress release announcement corroborates that this upgrade vulnerability can precipitate remote code execution.

The CVE classification identifies it as a time-of-check, time-of-use race condition, posing significant ramifications for data confidentiality, integrity, and availability.

As per the analysis provided by Wordfence, attackers able to access the exposed installer could orchestrate a staged installation, establish an administrator account, and upload deleterious PHP code.

Such access could facilitate backdoors, content manipulation, or information theft. Notably, observed requests predominantly targeted installer files within predictable upgrade directories.

Wordfence’s analytics reveal that the peak of attack traffic occurred on October 30, when its firewall thwarted more than 74,000 requests. The highest volume of activity transpired between October 29 and November 1.

It is crucial to note that these figures represent blocked requests, not verified infections, successful code execution, or the specific number of individual websites compromised.

Previous reports detailing 60,000 WordPress attack attempts made similar clarifications. While recurrent automated requests can enhance the chances of locating an exposed installer, total request tallies alone do not ascertain whether attackers accomplished the necessary steps or secured persistent access.

Administrators are advised to install WordPress version 7.1.4 or the corresponding patched version for their specific branch. Although automatic background updates may have applied the fix, it is imperative for owners to confirm completion.

WordPress underscores the necessity of prompt updating, emphasizing that only its latest release continues to receive active support.

Transitioning from a vulnerable version still necessitates utilizing the existing upgrade process once. Wordfence’s guidance recommends restricting public access to PHP files within /wp-content/upgrade/ prior to conducting updates.

This protective measure necessitates an Extended Protection mode, as staged PHP files operate outside the conventional WordPress loading parameters.

Indicators of Compromise

Source link: Cybersecuritynews.com.