Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-119977: WordPress core upgrade race flaw exploited, CISA KEV, fixed in 7.1.4

CISA added WordPress core CVE-2026-119977 to its exploited list on 3 November; here is who is affected, the 7.1.4 fix and what to check in your logs.

audiotale.net team

· 8 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

CISA added a WordPress core flaw to its Known Exploited Vulnerabilities catalog on 3 November 2026, six days after the project shipped the fix. The bug, now tracked as CVE-2026-119977, sits in the one place site owners are told to trust most: the core update process. Anyone running WordPress 7.1.3 or earlier, on a branch back to 4.7, should confirm they are on a patched release or have the backport for their branch.

Key points

  • CVE-2026-119977 is a time-of-check time-of-use (TOCTOU) race condition in the WordPress core upgrade process that can lead to unauthenticated remote code execution, fixed in WordPress 7.1.4, released 28 October 2026.
  • CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 3 November 2026 with a federal due date of 6 November 2026.
  • The Hacker News, relaying Wordfence, gives the affected range as WordPress 4.7 through 7.1.3 and a CVSS score of 8.1; Wordfence it reports blocking 62,969 attack attempts in one 24-hour period.
  • Exploitation needs the attacker to hit a window of seconds while WordPress unpacks a complete core update, so attack complexity is high, and Wordfence had not reported successful compromises when SecurityWeek wrote it up.
  • The WordPress project says the security fixes were backported to every branch still eligible for them, currently through 4.7, and that those backports ship as they become ready.

What to do

Who is affected. Sites running WordPress core 7.1.3 or earlier. The Hacker News, relaying Wordfence, puts the lower bound at 4.7, and the WordPress project's own post says it backported the fixes to all branches that receive security fixes, "currently through 4.7". The backports were described as "in progress" on 28 October, so a site on an older branch should check that its branch has received its patch release rather than assume it.

The fix. Update to WordPress 7.1.4 from the Updates screen in the dashboard, or download it from WordPress.org. Sites with automatic background updates enabled start the update on their own. Sites on an older branch should apply that branch's security release when it appears.

How to check whether you were targeted. Wordfence advises looking in your web server logs for suspicious requests to PHP files under wp-content/upgrade, and for unfamiliar administrator accounts, plugins or PHP files. Repeated requests for setup-config.php under a staging path are the pattern the company describes.

If you cannot update immediately. Neither WordPress nor Wordfence, in the pages we read, publishes a formal workaround. The advisory's own description of the mechanism, a web-accessible staging directory, points to an obvious hardening idea: deny public web access to wp-content/upgrade at the web server. That is our inference from the mechanism, not a vendor-supplied mitigation, and it should be tested on a staging copy first because it could interfere with how some hosts run updates.

What happened

WordPress 7.1.4 was released on 28 October 2026 as a security release. The announcement, written by release lead Aaron Jorbin, describes it as fixing multiple issues and recommends updating immediately. The first item in its list of security fixes is "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window", credited to Umut Bayram. BleepingComputer identifies Bayram as a researcher at Picus Security.

The announcement carried no CVE number. When The Hacker News and SecurityWeek covered the story in the following days, both reported that none had been assigned. SecurityWeek has since added an update dated 4 November: the identifier CVE-2026-119977 has been assigned and CISA has added it to the KEV catalog.

CISA's catalog entry, which we read in the agency's published JSON feed, lists the product as WordPress Core and classes the flaw as CWE-367, the weakness category for time-of-check time-of-use race conditions. It describes the impact as allowing "unauthenticated attackers to execute code on the server during the upgrade window", a result of "predictable, web-accessible staging paths used during full-package core upgrades". It gives a due date of 6 November 2026, which BleepingComputer reports as the deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. The same entry marks known ransomware campaign use as "Unknown" and sets the forensic triage field to "Yes".

Background

WordPress updates itself in two broad ways. Minor and security releases are often applied automatically in the background, while a full-package update downloads a complete copy of WordPress, unpacks it into a temporary directory, and then moves the files into place. The flaw lives in that temporary step.

According to Wordfence, as relayed by The Hacker News, affected versions unpack the new files of a full-package core update into a predictable directory under wp-content/upgrade. That staged copy includes the WordPress installer. Because the staging directory is web-accessible on many servers, Wordfence's Alex Thomas says, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged copy and progress to PHP code execution.

SecurityWeek, summarising Defiant, the company behind Wordfence, lists what the attacker needs: a full-package update that contains the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to finish before WordPress cleans up the temporary files. That is why the attack complexity is rated high. The attacker is not exploiting a standing hole; they are racing a clean-up routine that runs every time a site performs such an update.

The fix, per SecurityWeek, randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.

This is not the first time in recent weeks that a trusted update path has been the weak point. We covered the cPGuard update channel hijack, where attackers pushed a backdoor through a security plugin's own updater. The WordPress case differs: nobody tampered with the update itself, the attack targets the moment it runs.

The numbers

Exploitation attempts started almost at once. SecurityWeek, quoting Wordfence telemetry, says the first match for the company's new firewall rule arrived nine minutes after the rule was deployed, and that in the first 21 hours the company recorded more than 18,500 requests aimed at staged setup-config.php installer paths.

The Hacker News, writing later, quotes Wordfence as saying it blocked 62,969 attacks targeting the vulnerability over the past 24 hours, and that two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours. The two figures measure different things over different windows (requests recorded versus attacks blocked), so they should not be added together or read as one growing series. Both come from a single vendor's telemetry across its own customers, which means they show that scanning is widespread, not how many sites are actually vulnerable or compromised.

Wordfence also notes that in lab conditions the exploitable window lasts only seconds. Attackers are compensating by polling paths such as setup-config.php repeatedly, in the hope that one request lands while a site happens to be mid-update. Wordfence says that not every request used the exact vulnerable path, but that the sustained polling and probes of exact directory layouts show attackers quickly understood the race.

The Hacker News reports a CVSS score of 8.1, in the high band. The WordPress.org announcement gives no score.

What it means

For site owners. The practical risk is concentrated in the minutes when your own site updates itself. A site that rarely performs full-package updates has a rarely open window; a host that updates many sites on a schedule creates many predictable windows. Updating to 7.1.4 removes the predictable staging path for future updates. The open question for any given site is whether the update that installs the fix is itself exposed, and the sources we read do not address that.

For hosts and agencies. Anyone managing fleets of WordPress sites should expect probing traffic to wp-content/upgrade and setup-config.php in their logs, and should treat unexpected PHP files in that tree, new administrator accounts or unfamiliar plugins as incident indicators, as Wordfence advises. CISA's forensic triage marker in its KEV entry points the same way: for exposed sites, patching alone may not be the end of the job.

For the wider ecosystem. WordPress.org's announcement also lists a long run of other fixes in the same release: several stored cross-site scripting issues, including ones reported by Anthropic, a stored denial of service in the Interactivity API, unauthenticated discovery of unpublished Customizer changesets, a Notes access weakness, and an update to bundled root certificates because of the eMudhra revocation. SecurityWeek counts 22 security defects in total. The core-update race attracted the attention, but a site that delays the update is exposed to the rest of the list too.

What we don't know yet

  • Whether any sites were compromised. SecurityWeek says Wordfence had not reported successful compromises. We have seen no confirmed victim list.
  • The status of every backport. The WordPress post said backports to older branches were in progress and would ship as ready. We did not verify which patch releases had shipped for each branch at the time of writing.
  • Whether the update itself is exposed. The sources describe the vulnerable window as the time WordPress unpacks a complete core update. They do not say whether applying the fix through that same mechanism carries risk, or whether hosts that block web access to the staging directory are safe.
  • CVSS and severity. The 8.1 score reported by The Hacker News is the only one we found. We did not find a score from NIST's National Vulnerability Database, and the project's own announcement gives none.
  • Who is behind the polling. Wordfence describes sources but does not name actors, and nothing in the reports links the activity to a particular group.

What to watch next

  • Patch releases for older WordPress branches, which the project said would ship as they become ready.
  • A change to Wordfence's or CISA's entries if compromises are confirmed or ransomware use is established; the KEV field is currently "Unknown".
  • Hosting providers announcing server-side blocks on wp-content/upgrade, which would show how the industry reads the risk.
  • The 6 November CISA deadline for federal agencies, after which agencies must have patched or applied the vendor's mitigations.
  • WordPress 7.2, planned for 8 December 2026 according to the 7.1.4 announcement, and its Beta 3, which the project says already contains the applicable fixes.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next