❌

Normal view

Received — 6 November 2026 ⏭

PSA: CVE-2026-119977 is being exploited during core updates. Check you’re on 7.1.4 (or your branch’s backport)

✇posts from Frontend, drupal, Panama, reactjs, devops, selfhosted, webhosting, Wordpress, web_design, webdev, PHP, technology, ProgrammerHumor, CRM
By: /u/Arelvox
6 November 2026 at 03:31

If your site doesn’t auto-update, check now. During a full-package core update, older versions unpacked the new files (including setup-config.php) into a predictable folder under wp-content/upgrade/. Attackers poll for that window. Wordfence logged 18,500+ requests in the first 21 hours, and it’s in CISA’s KEV list since Nov 3.

Fixed: 7.1.4, 7.0.8, 6.9.11, 6.8.12 and backports down to 4.7.

Extra hardening, in your site-root .htaccess:

RewriteRule ^wp-content/upgrade/ - [F,L]

Then check that /wp-content/upgrade/ returns 403.

submitted by /u/Arelvox to r/Wordpress
[link] [comments]

PSA: CVE-2026-119977 is being exploited during core updates. Check you’re on 7.1.4 (or your branch’s backport)

✇WordPress
By: /u/Arelvox
6 November 2026 at 03:31

If your site doesn’t auto-update, check now. During a full-package core update, older versions unpacked the new files (including setup-config.php) into a predictable folder under wp-content/upgrade/. Attackers poll for that window. Wordfence logged 18,500+ requests in the first 21 hours, and it’s in CISA’s KEV list since Nov 3.

Fixed: 7.1.4, 7.0.8, 6.9.11, 6.8.12 and backports down to 4.7.

Extra hardening, in your site-root .htaccess:

RewriteRule ^wp-content/upgrade/ - [F,L]

Then check that /wp-content/upgrade/ returns 403.

submitted by /u/Arelvox
[link] [comments]
❌