WordPress core 4.7 to 7.1.3 upgrade-window race (remote code execution), fixed in 7.1.4 and branch backports

WordPress core 4.7 to 7.1.3: an unauthenticated race in the core update process can lead to remote code execution, fixed in 7.1.4 and backported to every supported branch, with Wordfence reporting exploitation attempts; Wordfence assigned CVE-2026-119977

WordPress 7.1.4, released on 2026-10-28, fixes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, and backports follow for every branch that receives security fixes, currently through 4.7 (WordPress.org, 2026-10-28); WordPress's release documentation counts 22 vulnerabilities, as Wordfence reports (Wordfence, 2026-10-29). During a core update with a complete package, the new files are unpacked into a predictable directory under wp-content/upgrade; the temporary copy includes the installer, and an unauthenticated attacker who requests it at the right moment can interact with the staged copy and reach PHP code execution (Wordfence, 2026-10-29). Wordfence scores it CVSS 8.1 for versions 4.7 through 7.1.3 and states that the attack complexity is high, because the attacker needs web access to the staging tree and must win a race that lasted only seconds in its lab (Wordfence, 2026-10-29). Patchstack reads the same flaw as needing wp-content/upgrade/ to be reachable over the web, notes that the sink dates back to WordPress 2.8 and that the window returns on every update, unattended ones included, and would not call it practical to exploit (Patchstack, 2026-10-28).

Wordfence reports that its new firewall rule matched within nine minutes of deployment and that it recorded more than 18,500 requests for staged setup-config.php installer paths in the first 21 hours, with two large sources polling small groups of sites for about 14.5 hours, which it reads as attempts to catch the update window (Wordfence, 2026-10-29). No source reports a successful compromise; Wordfence tracks the flaw as CVE-2026-119977, a time-of-check time-of-use race condition (Wordfence Intelligence, 2026-10-31). The fix randomises the staging directory, adds an index guard and prevents unsafe promotion of staged configuration data (Wordfence, 2026-10-29). Most sites receive the release through automatic background updates, which Wordfence says should be checked rather than assumed (Wordfence, 2026-10-29).

Triage: a request to a staging path outside an update window finds only an index.php and is probing, not compromise; a successful response from the staged installer during an update is the event that matters.