Hackers Tried to Break Into WordPress Sites 240,000 Times After a Security Flaw Was Found
Photo: CoinCentral
TLDR Wordfence blocked more than 240,000 attempts to exploit a WordPress flaw by November 6. The bug, CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3. CISA added it to its exploited vulnerabilities list and set a November 6 deadline for federal agencies. Sites can stay exposed while installing the very update that fixes the flaw. WordPress 7.1.4 fixes the issue, and Wordfence advises blocking PHP files in one folder first. WordPress has a security flaw that attackers are targeting during the website update process. The flaw is tracked as CVE-2026-119977. It does not rely on weak passwords or old plugins.
Source: CoinCentral
