A security flaw in WordPress is being actively targeted by attackers during the website update process. The cybersecurity firm Wordfence has blocked more than 240,000 exploitation attempts as of November 6, and US regulators have given federal agencies a deadline to patch. The vulnerability, tracked as CVE-2026-119977, does not rely on weak passwords or old plugins. Instead, it lies in how WordPress handles certain full software upgrades.

During these upgrades, WordPress briefly unpacks installation files into a folder that the public can reach. The window lasts only seconds, but that short moment is exactly what attackers are trying to catch.

⚠️ALERT: Hackers are now targeting WordPress, the software behind 39.5% of all websites online. A critical flaw lets attackers take over a WordPress site in the seconds it spends updating, without needing to log in. During a full update, WordPress briefly stages its installer… pic.twitter.com/vYPYviWSw7

— Coin Bureau (@coinbureau) November 6, 2026

How the Attack Works

An attacker who reaches those files at the right moment may be able to run malicious PHP code. They would not need to log in to the site first, and weak passwords or outdated plugins play no role in the exploit. A successful attack could allow them to install backdoors, change website content, create unauthorized administrator accounts, or steal sensitive information. Bugs that require no credentials are counted among the most serious classes of web vulnerabilities, because the usual login defenses — strong passwords, two-factor authentication, plugin hygiene — never come into play.

The flaw carries a CVSS severity score of 8.1 out of 10, placing it in the high-risk category of the standard 0-to-10 vulnerability scale. According to Wordfence, it affects WordPress versions 4.7 through 7.1.3, a range that covers nearly a decade of releases. Because WordPress runs about 39.5% of all websites worldwide, according to W3Techs, the population of potentially exposed sites is substantial — a single flaw in the software's core can put blogs, media outlets and businesses into the same risk pool until they are patched.

Wordfence says attackers began targeting the flaw on October 28, the same day WordPress released its security update. Across the software industry, the release of a public fix is treated as a potential starting signal for attackers, since patches can reveal the weaknesses they repair — one reason security teams press administrators to update immediately rather than on a routine schedule. Early monitoring found more than 18,500 suspicious requests in about 21 hours, and the numbers then grew steadily. By November 6, the Wordfence firewall had blocked more than 240,000 exploitation attempts. The single biggest day was October 30, when more than 74,000 malicious requests were blocked.

Researchers also saw attackers probe sites repeatedly over long periods, apparently waiting for vulnerable sites to enter the brief update window in which installation files become publicly reachable. The blocked requests do not equal confirmed hacks. Exploitation requires precise timing, which makes taking over a site considerably harder than sending a request. Even so, the volume of traffic shows strong interest from attackers.

Fix, Deadline and Advice for Site Owners

WordPress released version 7.1.4 on October 28. The release fixes the flaw along with several other security issues, and patches are also available for older supported branches, so administrators on legacy versions can apply fixes as well.

On November 3, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog — a list reserved for bugs confirmed to be actively exploited — and gave federal civilian agencies until November 6 to fix it. Catalog entries are mandatory rather than advisory: under CISA's Binding Operational Directive 22-01, federal civilian agencies are required to remediate listed vulnerabilities by the deadline assigned to each bug. CISA has confirmed the flaw is being exploited in the wild.

Researchers also flagged a catch for sites that remain vulnerable. Because the old, unpatched software handles the first step of the upgrade, a site can stay exposed even while it is installing the very update that fixes the flaw. Wordfence advises blocking web access to PHP files in the /wp-content/upgrade/ directory before starting the update.

The company has already added firewall protection for its Premium, Care and Response customers, and users of the free plugin are set to receive the same protection on November 27. Administrators are told to confirm the update has finished, check server logs, and review administrator accounts for unauthorized changes.

Crypto businesses that run on WordPress face added risk, according to the reports. Exchanges, blockchain projects and crypto news sites could see website tampering or phishing links injected into their pages. The flaw does not directly affect blockchain networks or wallets, but a hacked site could still trick visitors into connecting wallets or approving false transactions — a reminder that for crypto firms, the website in front of the chain is part of their operational security.

As of November 6, Wordfence had blocked more than 240,000 attempts to exploit the vulnerability, and administrators are being urged to install WordPress 7.1.4, apply the recommended directory protections, and verify their sites afterward. The dates now on the calendar — the November 6 federal patch deadline and the November 27 rollout of firewall protection to free-plugin users — are the visible checkpoints to watch as the response plays out, alongside Wordfence's running count of blocked attempts.