WordPress Patches Actively Exploited Core Upgrade Flaw

Malaysia’s National Cyber Coordination and Command Centre (NC4) has issued an advisory warning of active exploitation targeting WordPress Core. Tracked as CVE-2026-119977, the race condition allows unauthenticated remote attackers to execute arbitrary code during core upgrades. The flaw affects WordPress Core versions 4.7 through 7.1.3 when the upgrade directory is reachable over HTTP. Following evidence of automated attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities Catalog. Malaysian organisations and website administrators are advised to immediately restrict access to staging folders and apply vendor updates.

Key Facts

How Does the Upgrade Race Condition Work?

During a full-package upgrade, WordPress unpacks its new release into a web-accessible directory under wp-content/upgrade/. Because the folder name is predictable and can be exposed via directory listing, an unauthenticated attacker can briefly access the staged installer file wp-admin/setup-config.php over HTTP and connect it to a malicious database.

A website becomes exposed when three concurrent conditions are met: the site runs an affected core release between 4.7 and 7.1.3, the wp-content/upgrade/ directory is reachable over the web, and a full-package core upgrade is initiated. If an adversary reaches the staged installer during the brief upgrade window, they can complete setup routines pointing to an external database under their control. This can lead to arbitrary PHP code execution under web server permissions, full site takeover via web shells or unauthorised administrator accounts, and credential theft.

Because the staged upgrade package loads WordPress from its own temporary files, traditional WordPress security plugins are bypassed and cannot inspect the malicious HTTP requests.

Is the Vulnerability Being Actively Exploited in the Wild?

Yes. Security vendors have observed high volumes of automated exploitation attempts directed against WordPress upgrade paths since patches were released on 28 October 2026. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities Catalog on 3 November 2026 based on verified exploitation evidence.

Although public reports have not confirmed specific successful intrusions, threat actors have deployed automated scanners that poll target websites continuously. Because the attack complexity is rated high due to the race condition lasting only a few seconds, automated polling allows attackers to compensate for timing constraints. Furthermore, the vulnerability requires neither credentials nor user interaction, and the attack surface is reopened on every subsequent update cycle.

Threat actors use automated polling tools to detect and exploit the brief multi-second window during which the WordPress installer files reside in the staging folder.

What Should You Do?

• Block access to the upgrade directory: Configure web servers (Apache or Nginx) or reverse proxies to deny all HTTP requests to /wp-content/upgrade/ and disable directory listing. Ensure this rule remains permanently active.
• Configure edge firewalls: Verify that reverse-proxy or edge Web Application Firewalls (WAF) inspect and block web requests to /wp-content/upgrade/, rather than relying on application-level WordPress firewall plugins.
• Apply official core updates: Update installations to WordPress 7.1.4 or the corresponding patched security release for your current branch (down to branch 4.7). Migrate any installations running version 4.6 or earlier, as they no longer receive security fixes.
• Verify installations and environments: Check site versions using the administrative dashboard or wp core version. Verify staging, development, and cloned sites, and prioritise environments where background updates are disabled.
• Conduct compromise assessments: Inspect web server access logs around update windows for HTTP 200 responses to wp-admin/setup-config.php, notably POST requests with step=2. Audit network telemetry for unexpected outbound database connections, run wp core verify-checksums, and inspect wp-config.php and administrative user accounts.
• Report incidents: Malaysian National Critical Information Infrastructure (NCII) entities must report suspected exploitation or compromise under the Cyber Security Act 2024 [Act 854]. Other organisations should submit reports via NACSA designated reporting channels or Cyber999.

Common Questions

Are automated background updates vulnerable to this flaw?

Yes. The race condition occurs during any full-package update process, regardless of whether it is triggered manually from the dashboard, executed via WP-CLI, or run automatically in the background. The exposure window reopens during every update cycle until web access to the upgrade directory is denied.

Why do WordPress firewall plugins fail to block the attack?

Security plugins execute within the active WordPress runtime environment. Because the staged upgrade copy in wp-content/upgrade/ loads WordPress independently from its own temporary files, requests hitting the staged installer never trigger the active plugins, bypassing all application-level inspection.

Will blocking the upgrade directory disrupt future WordPress updates?

No. WordPress manages core updates internally through local filesystem operations rather than through HTTP requests. Restricting web access to wp-content/upgrade/ at the server or proxy level prevents external network users from accessing staged setup files without impeding core update functions.

Sources and Methodology

This security dispatch is based entirely on the advisory issued by the National Cyber Coordination and Command Centre (NC4) under Malaysia's National Cyber Security Agency (NACSA) (Advisory Reference: NC4-ALR-2026-000016), reflecting information available as of 5 November 2026 and updated on 7 November 2026. Supporting vulnerability status entries are referenced from the CISA Known Exploited Vulnerabilities Catalog and the NVD entry for CVE-2026-119977. This reporting relies solely on the provided official advisory text without external verification or independent analysis.