Updating your website is supposed to be the responsible, eat-your-vegetables part of running it. This week we learned that, for a few seconds during a WordPress core update, the vegetables could run arbitrary PHP. CISA has now confirmed that attackers are trying to take that bite.
Five seconds, one staged installer
On November 3, CISA added CVE-2026-119977, a race condition in WordPress core's upgrader, to its Known Exploited Vulnerabilities catalog. Federal civilian agencies have until Friday, November 6 to fix it. WordPress shipped the fix in version 7.1.4 on October 28 and backported it to older branches as far as 4.7, telling site owners to update immediately.
According to reporting from Tech Insider, the bug lives in the brief window when WordPress unpacks a full core update into a staging folder under wp-content/upgrade. On many servers that folder is reachable over the web, and an unauthenticated visitor who hits the staged installer at exactly the right moment can push it toward code execution. Wordfence testing reportedly found the window lasts only a few seconds, so attackers run scripts that poll continuously until they catch it. Wordfence data cited in the coverage puts recent attempts at more than 12,600 a day.
Your updater is now part of the attack surface
We usually treat "apply the update" as the end of the security conversation. This flaw makes the update process itself the target, which is a lovely bit of irony for anyone who has ever told a client that patching fixes everything. Public reporting hasn't tied any confirmed compromises to the bug yet, but attackers wouldn't bother polling a few-second window on thousands of sites if they didn't expect it to pay off.
The detail most people will skim past is that this attack depends on server configuration as much as on WordPress code. A host that blocks web access to wp-content/upgrade closes the window no matter how fast the race runs. Tech Insider also reports that Wordfence's free-tier firewall rule won't arrive until November 27, so sites relying on the free plan should update rather than wait for the firewall.
Update to 7.1.4 (or the patched release on your branch), and then check whether your staging directories should be visible to the public internet at all. Most of them shouldn't be.
If this has you wondering which other "routine" maintenance steps on your site could be turned against you, our free developer security checklist for defending against supply chain attacks is a good place to start.
Source: Tech Insider