Imagine that you are updating your WordPress website. During that period, while WordPress updates, an attacker repeatedly sends requests to a predictable temporary folder, attempting to access it at just the right moment. If successful, the attacker can exploit the exposed installation files to execute arbitrary code on the server and potentially gain control of your website.

This is exactly what happens when the recently disclosed RCE flaw(tracked as CVE-2026-119977) in WordPress is exploited.

Through our blog, we will understand what the WordPress Core flaw is about, the threat an attacker poses by exploiting it, and what organizations can do to defend.

About the vulnerability

On 29th October, Cursor identified a security incident involving Anthropic’s Claude Code version 2.1.313 in its Cursor VS Code extension Marketplace that was not developed by Anthropic. The malicious version allowed attackers to create a persistent SSH backdoor.

Fixed Version: WordPress 7.1.4

This vulnerability exists in WordPress Core’s update mechanism and in how it handles temporary files during a full package update.

What attackers can do with the flaw?

If an attacker is successful in exploiting the flaw, he can execute arbitrary code on the affected server. This could enable the attacker to:

• Steal sensitive website and database information.
• Obtain stored credentials and confirmation secrets.
• Modify websites or deface websites.
• Establish a mechanism for persistence via installation of a malicious script and backdoors.
• Disrupt website operations or take services offline.
• Attempt to compromise other systems in the hosting environment.

Official mitigation guidance

WordPress has released security updates to address the vulnerability. Organizations should update their installations to the applicable patched version.

The WordPress security release also recommends updating websites immediately and verifying that automatic background updates have completed successfully.

SharkStriker’s recommendations 

• Immediately update WordPress Core to version 7.1.4 or the corresponding patched release for the installed branch. Where possible, migrate to the latest supported WordPress version.
• Restrict direct access to wp-content/upgrade/ at the web server or WAF level.
• Prevent external requests from accessing files within this directory.
• Disable PHP execution within wp-content/upgrade/ and wp-content/uploads/ through appropriate Apache or Nginx server configurations to prevent malicious scripts from executing in these locations.
• Inspect the wp-content/upgrade/ directory for leftover files or unexpected PHP scripts from failed or incomplete updates. Investigate suspicious files before removing them.
• Review web server access logs for unexpected requests targeting setup-config.php or other PHP files under wp-content/upgrade/. Investigate suspicious activity and check for unauthorized file modifications or web shells.

SharkStriker’s Actions

• SharkStriker has reviewed the reported WordPress vulnerability and associated security updates to assess the potential impact on affected environments.
• Identified potentially affected customer environments and assessed the relevance of the vulnerability.
• Shared the security advisory with affected customers, highlighting the vulnerability, potential impact, and required remediation actions.
• Assessed relevant detection opportunities for attempts to exploit exposed WordPress upgrade directories.
• Provided recommendations to prioritize patching, review web server configurations, and investigate suspicious activity targeting WordPress upgrade files.