WordPress Core CVE-2026-119977: upgrade-window RCE now on CISA KEV (due Nov 6)
https://sockanalyst.com/patch-now/wordpress-core-cve-2026-119977-upgrade-rce

Splunk
index=* (uri_path="*/wp-content/upgrade/*" OR url="*/wp-content/upgrade/*" OR http_uri="*/wp-content/upgrade/*")
| stats count dc(src) as sources values(src) as src min(_time) as first max(_time) as last by uri_path, status, http_user_agent
| sort - count

Sentinel
union isfuzzy=true
 (CommonSecurityLog | where RequestURL has "/wp-content/upgrade/"),
 (AzureDiagnostics | where requestUri_s has "/wp-content/upgrade/"),
 (DeviceNetworkEvents | where RemoteUrl has "/wp-content/upgrade/")
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP=coalesce(SourceIP, clientIP_s, InitiatingProcessRemoteIP), RequestURL=coalesce(RequestURL, requestUri_s, RemoteUrl), DeviceName