WordPress sites still running core 7.1.3 or older are being probed for a race condition that only exists while the site is upgrading itself. The fix has been out since 28 October.

What happened

WordPress 7.1.4, released on 28 October alongside backported releases for older branches, closes CVE-2026-119977. Full-package core upgrades write their staging files to predictable, web-accessible paths under the upgrade directory, so an unauthenticated attacker who reaches the installer while an upgrade is running can complete the staged installation, create an administrator account and upload PHP of their choosing.

Wordfence reports that attackers started targeting the flaw on disclosure day and that its firewall has blocked more than 240,000 exploit attempts. The traffic follows a single pattern: requests to setup-config.php inside a version-named staging directory. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2 November.

Who is affected

• WordPress core versions 4.7 through 7.1.3, including current 7.x installs that missed the October update
• Agencies and hosts managing multiple client sites, where one stale install is enough
• Sites with automatic background updates still pending or disabled

What to do now

Update to WordPress 7.1.4 or the matching patched release for your branch, and block PHP execution in the upgrade directory before you do it.

• Confirm the core version on every site you are responsible for, not just the ones on a maintenance contract
• Deny web access to PHP files under the upgrade directory at the web server or WAF before patching, since the patched update still runs the vulnerable process once
• Search access logs for requests to setup-config.php under that directory and treat any hit as hostile
• Review administrator accounts and installed plugins for anything unexpected
• Check the upgrade directory for leftover staging folders and remove them

What this means for South African businesses

Almost every SME here has at least one WordPress site, usually built years ago by someone who is no longer around, and those are the installs that sit a version behind. The exploit is hard to land: it needs the attacker to arrive inside a window measured in seconds, so most individual sites will never be hit. The judgment call is that volume replaces precision, because 240,000 attempts against millions of sites finds the slow upgraders, and a compromised SME site usually surfaces weeks later as spam, a phishing page or a search-engine warning rather than as an incident.

Source: Wordfence.

Also on the blog

• N-able N-central: 33 zero-days published, hotfix fixes 7 CVEs
• Zoom Workplace for Windows CVE-2026-108186: CVSS 9.6, fixed in 7.1.8

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.