The WordPress core flaw fixed on October 28 is now on a U.S. government list of exploited vulnerabilities. Wordfence says attackers started targeting it the day it was disclosed.

Wordfence reports its firewall has blocked over 240,000 exploit attempts. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog on November 2.

What the flaw does

It is an unauthenticated remote code execution bug. That means someone with no login could run code on your server. It affects WordPress core versions 4.7 through 7.1.3.

There is a catch. It is a race condition, so attackers can only use it during the short window while a core upgrade is running. Wordfence says that makes real compromise difficult in practice.

We first covered the fix in our WordPress 7.1.4 security release article. We reported the first exploitation attempts six days ago. The volume is now much clearer.

What to do

  • Check Dashboard, then Updates, and confirm your site runs WordPress 7.1.4 or a backported security release for your older branch.
  • If you manage sites that update on a schedule, run the update now instead of waiting.
  • Do not leave a site stuck halfway through an upgrade. Finish it or restore from backup.

Wordfence says paid users got a firewall rule on October 28. Free users get the same rule on November 27. Updating WordPress closes the hole without waiting for that.

End of article