Attackers have sent more than 240,000 attempts at a WordPress core flaw that opens while a site is updating, according to security vendor Wordfence. Wordfence says its firewall “has blocked over 240,000 exploit attempts since the vulnerability was publicly disclosed”. The fix is WordPress 7.1.4, released on 28 October, or the matching patched release for older branches.
WordPress runs 39.4% of all websites, according to W3Techs, and every WordPress version from 4.7 through 7.1.3 is affected, according to Wordfence.
Business Pill · Least Privilege
An evergreen Business Engineer explainer on giving systems only the access they need. It teaches the general idea only and does not discuss this WordPress flaw.
The key insight: Wordfence says its firewall has blocked more than 240,000 attempts at a WordPress core flaw that opens during site updates, peaking at over 74,000 on 30 October. The fix is WordPress 7.1.4 or the matching patched release, and WordPress runs 39.4% of all websites, according to W3Techs.
Wordfence describes the bug, tracked as CVE-2026-119977 and rated 8.1 (High), plainly: “WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3”. In short, installer files are briefly reachable during updates.
If an attacker reaches a site in that window, Wordfence says, they “can complete the staged installation, create an administrator account for it, and upload malicious PHP code to the server”. No password is needed: Wordfence calls it unauthenticated.
Because the weakness is in the update process itself, Wordfence notes that “updating from a vulnerable version to the patched version will run the vulnerable upgrade process one last time”. After that, future upgrades are no longer affected.
Attempts on the WordPress upgrade-window flaw that Wordfence’s firewall blocked, from disclosure on 28 October to Wordfence’s 5 November report. Blocked attempts are not successful breaches; the share and day counts are our arithmetic.
What the Attack Data Shows
Attempts began on 28 October, the day the flaw was disclosed, according to Wordfence. The highest volume came between 29 October and 1 November, “peaking on October 30th when over 74,000 exploit attempts were blocked in a single day”.
By our arithmetic, that single day is about 31% of the 240,000-plus total. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on 2 November, Wordfence says, 5 days after the release by our count.
Wordfence adds a caution on the numbers: “The large number of blocked requests does not mean that a large number of sites have been successfully exploited”. It says most are likely automated attempts timed to catch a site mid-update, which is a narrow window.
Who Found the Bugs
The WordPress 7.1.4 release notes credit the upgrade-window flaw to researcher Umut Bayram. The same release lists 13 items, 12 of them vulnerability fixes by our count, and two of those are credited to Anthropic: a stored XSS in Privacy Data Removal Requests and one in specially crafted User Logins.
WordPress.org says that “Because this is a security release, it is recommended that you update your sites immediately”, and that sites with automatic background updates will update on their own. Wordfence says sites with automatic background updates “should already have been updated to a patched version”.
For the one-time update window, Wordfence says that blocking access to PHP files in the upgrade directory at the web server level “before updating provides additional protection”. It also recommends reviewing installed plugins and WordPress users “for anything unexpected”.
The fix was backported to every branch still eligible for security fixes, back to 4.7, WordPress.org says; Wordfence lists 25 patched versions, by our count. WordPress.org also reminds users that “only the most recent version of WordPress is actively supported”.
As we read Wordfence’s figures, the attempts cluster in the first four days after disclosure, from 29 October to 1 November, which is when sites that had not yet updated were exposed.
As we read the release notes, the patch is broader than one flaw: by our count it carries 12 vulnerability fixes, two of them credited to Anthropic.
Wordfence, 5 November 2026
“The large number of blocked requests does not mean that a large number of sites have been successfully exploited”
Three Implications
FOR SITE OWNERS WordPress.org says it is recommended that sites update immediately, and that sites with automatic background updates update on their own.
FOR HOSTS AND AGENCIES Wordfence says blocking access to PHP files in the upgrade directory at the web server level before updating provides additional protection.
FOR SECURITY TEAMS Wordfence recommends reviewing installed plugins and WordPress users for anything unexpected; CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2 November.
The framework puts it this way: “The value proposition shifts from features to integration depth.”
As we read it, WordPress is that kind of woven-in layer for 39.4% of all websites, per W3Techs, which is why a flaw in its update process reaches the businesses built on it. The framework predates this flaw and does not discuss it.
What Is Not Established
Wordfence’s figures count attempts its own firewall blocked, not successful break-ins, and it does not say how many sites were compromised. The share of WordPress sites still running an unpatched version is not reported in these sources.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
More than 240,000 attempts have targeted a WordPress flaw that opens during updates, according to Wordfence, with a peak of over 74,000 on 30 October. The fix is 7.1.4 or the matching patched release, and WordPress runs 39.4% of all websites, per W3Techs.
A note on sourcing. Attack figures are attempts blocked by Wordfence’s firewall as reported on 5 November 2026, not confirmed breaches. Release details are from WordPress.org; the web share is from W3Techs. Counts, shares and day counts are ours. This piece omits technical exploit detail by design.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
