Following up on our WordPress 7.1.4 item: Wordfence, which is the CVE Numbering Authority for the bug, tracks the upgrade-window flaw as CVE-2026-119977 (CVSS 3.1 8.1, high attack complexity). During a full-package core update, WordPress unpacks files, including the installer, into a predictable, web-reachable staging directory under wp-content/upgrade/; an unauthenticated attacker who requests the staged setup-config.php at the right moment can reach PHP code execution. In Wordfence's lab the window normally lasted only seconds. WordPress itself rates the issue Low (GHSA-4w3m-c66w-69mg).

Wordfence says its firewall rule saw its first match nine minutes after deployment, and it recorded more than 18,500 requests aimed at staged installer paths in the first 21 hours. Two of the largest sources polled small groups of sites for about 14.5 hours, consistent with waiting for an update to start. Not every request hit the exact vulnerable path, and Wordfence reports attempts, not confirmed takeovers. The CVE is not in CISA KEV.

What to do: confirm every site is on 7.1.4 or its branch's fixed release (4.7.39 through 7.0.8), and deny web access to wp-content/upgrade/ at the web server. Wordfence users should check that Extended Protection is enabled, since the exploit requests the staged PHP file directly without loading WordPress.