A critical security vulnerability in WordPress could allow attackers to take control of websites without logging in, according to a report by Hokanews. The flaw affects versions 4.7 through 7.1.3 and targets a brief window during the platform's update process, when its installer becomes temporarily accessible through a public folder.

WordPress powers 39.5% of all websites online, according to information shared by Coin Bureau, meaning roughly four in ten sites run on the same underlying software. That scale gives the reported weakness a potentially broad reach, since it involves the platform's own update process rather than a single plugin or theme. The concern centers on the possibility that attackers may be able to execute their own code directly on a website's server during a full update — an outcome that can translate into unauthorized control of the site itself.

How the Vulnerability Works

During a full WordPress update, the platform briefly stages its installer in a publicly accessible folder. According to Coin Bureau, an attacker who reaches that location during the short window can run their own code on the server. Because the exposure exists only while the update is in progress, the risk is tied to that temporary staging period rather than to a persistently open entry point.

The flaw does not require an attacker to log in to the affected WordPress site. Instead, the attack takes advantage of the temporary exposure created during the update process, potentially allowing unauthorized control of the website.

The vulnerability affects every WordPress version from 4.7 to 7.1.3. That range covers nearly 10 years of releases, dating back to December 2016, according to the information reported by Coin Bureau. A span that wide places installations of very different ages within the reported affected range, rather than only the most recent versions.

Wordfence Flags Vulnerability CVE-2026-119977

Security firm Wordfence flagged the issue, which is now tracked under the identifier CVE-2026-119977. The CVE designation is the standard identifier system used to catalog publicly disclosed software vulnerabilities, giving researchers and site owners a shared reference point for the same flaw. The vulnerability has also prompted firewall protection activity, with Wordfence recording its first block just nine minutes after the protection went live.

The reported timing indicates that the firewall began blocking activity associated with the vulnerability shortly after its protection was activated. However, the report does not specify the number of attempted attacks or how many websites may have been affected. Those two figures remain the main open questions around the flaw, since they would show how much activity it has attracted in practice.

With versions 4.7 through 7.1.3 included in the reported affected range, the vulnerability concerns a broad span of WordPress releases. The temporary installer exposure during full updates is the specific weakness described in the report.

The original report was written by Victoria Hale, a technology and blockchain writer at Hokanews.