Cybercriminals have initiated a staggering 240,000 attempts to exploit a vulnerability in the WordPress Core upgrade process, which could potentially facilitate unauthenticated remote code execution.
According to Wordfence researcher István Márton, these malicious endeavors commenced on October 28, 2026.
Identified as CVE-2026-119977, this high-severity flaw holds a CVSS score of 8.1 and impacts unpatched versions ranging from WordPress 4.7 to 7.1.3.
The vulnerability hinges on a remote code execution scenario linked to the staged installer, necessitating that attackers access temporary installation files during an ongoing upgrade.
This predicament arises from a time-of-check versus time-of-use race condition involving predictable, web-accessible staging directories generated during comprehensive Core upgrades.
Hackers Exploit WordPress Core RCE Vulnerability
These directories, located beneath/wp-content/upgrade/, house executable installer components.
An unauthenticated assailant capable of reaching the staged installer prior to its cleanup can initiate an alternate installation, create an administrator account, and upload malicious PHP scripts.
The release of WordPress version 7.1.4 has introduced several countermeasures, including randomization of staging directories, an index guard, and restrictions on the unsafe promotion of staged configuration data, thereby diminishing the potential for installer exploitation.
Notably, the observed attacks specifically targeted paths such as/wp-content/upgrade/wordpress-6.9.11/setup-config.php, strategically attempting to intercept sites while installer files remained accessible.
Should an attack succeed, it could yield server-side execution capabilities, allowing for backdoors, content alteration, and the theft of sensitive information. Wordfence Firewall (Source: Wordfence)
The transition from administrator to PHP in malicious plugins deployed within WordPress resembles this campaign; however, it capitalizes on temporary Core installer exposure instead of exploiting REST API route ambiguities or SQL injection vulnerabilities.
Crucially, attackers must complete their intrusion before the upgrade process deletes the staging directory.
Data from Wordfence’s telemetry demonstrates heightened activity between October 29 and November 1, with over 74,000 blocked requests registered on October 30.
Among the most prolific sources were IP address 103.59.160.171, responsible for over 74,900 requests; 2001:df1:e8c0::106b, managing more than 40,400 requests; and 51.89.103.78, accounting for over 34,600 attempts.
It must be noted that these figures reflect blocked requests—results do not confirm successful breaches.
Automated probing necessitates coinciding with the fleeting upgrade window, rendering successful exploitation much more complex than the sheer volume of requests suggests.
Administrators are advised to scrutinize access logs for external requests targeting PHP files located under/wp-content/upgrade/, particularly setup-config.php.
Legitimate upgrades do not entail public requests to these staged scripts, as outlined in the advisory.
Moreover, investigations should extend to lingering staging directories, unrecognized plugins, unfamiliar administrator accounts, and potential backdoors that could compromise site integrity.
While suspicious requests merit attention, they do not independently verify successful code execution, and absences of log entries do not definitively rule out compromises.
Site administrators are urged to promptly upgrade to WordPress version 7.1.4 or to a corresponding patched branch release.
Since an upgrade from an affected installation invokes existing upgrade logic, administrators should initially block web access to PHP files under /wp-content/upgrade/.
For optimal protection, Wordfence mandates that the firewall be operational in Extended Protection mode, as standalone staged scripts do not initiate WordPress. Premium defense measures were introduced on October 28, with free-tier coverage expected on November 27.
Source link: Gbhackers.com.
