---
title: WordPress upgrade-window RCE gets CVE-2026-119977, and Wordfence sees attackers polling for it | ctxsec
url: https://ctxsec.com/items/wordfence-cve-2026-119977-wordpress-upgrade-window-rce-exploitation-attempts
description: "Wordfence assigned CVE-2026-119977 (CVSS 8.1) to the unauthenticated upgrade-window remote code execution weakness fixed in WordPress 7.1.4 and branch releases back to 4.7.39. Its firewall saw the first exploit request nine minutes after its rule went live and more than 18,500 requests at staged setup-config.php paths in 21 hours. No successful compromise has been reported."
status: "official (Wordfence, the assigning CNA); exploitation attempts, no confirmed compromises; not in CISA KEV"
published: 2026-11-01
---

> Wordfence assigned CVE-2026-119977 (CVSS 8.1) to the unauthenticated upgrade-window remote code execution weakness fixed in WordPress 7.1.4 and branch releases back to 4.7.39. Its firewall saw the first exploit request nine minutes after its rule went live and more than 18,500 requests at staged setup-config.php paths in 21 hours. No successful compromise has been reported.

[← Cybersecurity News](/news) · [markdown](/items/wordfence-cve-2026-119977-wordpress-upgrade-window-rce-exploitation-attempts.md)

official (Wordfence, the assigning CNA); exploitation attempts, no confirmed compromises; not in CISA KEV

2026-11-01

### WordPress upgrade-window RCE gets CVE-2026-119977, and Wordfence sees attackers polling for it

Following up on our [WordPress 7.1.4 item](/items/wordpress-7-1-4-security-release-upgrade-rce-stored-xss): Wordfence, which is the CVE Numbering Authority for the bug, tracks the upgrade-window flaw as **CVE-2026-119977** (CVSS 3.1 **8.1**, high attack complexity). During a full-package core update, WordPress unpacks files, including the installer, into a predictable, web-reachable staging directory under `wp-content/upgrade/`; an unauthenticated attacker who requests the staged `setup-config.php` at the right moment can reach PHP code execution. In Wordfence's lab the window normally lasted only seconds. WordPress itself rates the issue Low (GHSA-4w3m-c66w-69mg).

Wordfence says its firewall rule saw its first match **nine minutes** after deployment, and it recorded **more than 18,500 requests** aimed at staged installer paths in the first 21 hours. Two of the largest sources polled small groups of sites for about 14.5 hours, consistent with waiting for an update to start. Not every request hit the exact vulnerable path, and Wordfence reports attempts, not confirmed takeovers. The CVE is not in CISA KEV.

**What to do:** confirm every site is on 7.1.4 or its branch's fixed release (4.7.39 through 7.0.8), and deny web access to `wp-content/upgrade/` at the web server. Wordfence users should check that Extended Protection is enabled, since the exploit requests the staged PHP file directly without loading WordPress.

Sources: [Wordfence: WordPress 7.1.4 security release RCE](https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/) · [WordPress.org: WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/)