INEAvailable
EWPT
CVE-2026-119977 WordPress Core Vulnerability: Patch Now
CVE-2026-119977 is a race condition in WordPress core upgrades that can lead to remote code execution. CISA added it to the KEV catalog on 2026-11-03, and WordPress 7.1.4 contains the fix.
Short answer: CVE-2026-119977 affects WordPress Core 4.7 through 7.1.3 and can let unauthenticated attackers run code during a full-package core upgrade. CISA added it to KEV on 2026-11-03, so update to 7.1.4, keep that upgrade short, and check your upgrade windows and logs.
CVE-2026-119977 is a remote code execution flaw in WordPress Core versions 4.7 through 7.1.3. An unauthenticated attacker can run code on your server during a core upgrade. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-03, and WordPress 7.1.4 is the fixed release.
What happened
The NVD record was published on 2026-10-31. It says WordPress Core uses "predictable, web-accessible staging paths" during full-package core upgrades.
That creates a time-of-check time-of-use (TOCTOU) race condition, tracked as CWE-367. An attacker can act in the gap between when WordPress checks a file and when it uses it. The result is code execution on the server during the upgrade window.
The WordPress project announced the fix in its 7.1.4 release post. The NVD references point to changes in class-wp-upgrader.php and update-core.php between tags 7.1.3 and 7.1.4.
Who is affected
Any site running WordPress Core from 4.7 through 7.1.3 is in scope. That is a very wide range of versions.
Item | Affected | Fixed |
|---|---|---|
WordPress Core | 4.7 through 7.1.3 | 7.1.4 |
The risk centers on full-package core upgrades. A site that is not mid-upgrade is exposed less directly, but you should still patch. Hosts and agencies that run upgrades across many sites should treat this as a fleet-wide task.
How serious it is and whether it is exploited
NVD lists a CVSS 3.1 score of 8.1 HIGH with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Read that closely.
AV:N and PR:N: attackable over the network with no login.
AC:H: high complexity, because the attacker must hit the upgrade window.
C:H/I:H/A:H: full impact on confidentiality, integrity and availability.
The high complexity keeps the score below critical. It does not make the bug safe to ignore. CISA added it to KEV on 2026-11-03 with a federal due date of 2026-11-06, which signals exploitation or a strong risk case. Known ransomware use is listed as Unknown.
What to do now
1. Update to 7.1.4 and keep the upgrade window short
Moving to 7.1.4 is itself a full-package core upgrade, so it opens the same window the bug abuses. Prepare first: take a backup, schedule it when traffic is low, and run it in one pass instead of leaving it half-finished. Then cover that window in the checks in steps 3 and 4.
wp core version
wp core update --version=7.1.4
wp core verify-checksumsThe checksum check confirms core files match the official release. Run it after the update.
2. Check whether updates run automatically
Background updates may already have moved you to 7.1.4. Confirm rather than assume:
wp core version
wp config get WP_AUTO_UPDATE_COREIf the second command returns an error, the constant is not set and WordPress uses its default behavior.
3. Look for leftover staging files
The flaw involves staging paths used during upgrades. Look for unexpected files and recently changed PHP files in your web root.
The date 2026-10-31 is only the NVD publication date. Affected versions go back to 4.7, so a site could have been hit during any earlier full-package upgrade. Set the -newermt date to your earliest relevant core upgrade, not the disclosure date. Include the upgrade to 7.1.4 you just ran.
find /var/www/html -type d -name 'wordpress*' -newermt 'YYYY-MM-DD' 2>/dev/null
find /var/www/html -name '*.php' -newermt 'YYYY-MM-DD' -not -path '*/wp-content/cache/*'Replace YYYY-MM-DD with that date and adjust the path to your install. Review every hit. Legitimate plugin and theme updates will show up too, so compare against your change history.
4. Check web logs around upgrade times
Search access logs for requests to unusual PHP files during past upgrades, including the one you just ran:
grep -E 'POST .*\.php' /var/log/nginx/access.log | grep -v 'wp-login.php\|admin-ajax.php\|xmlrpc.php' | tail -n 200Use your Apache log path if you run Apache. Odd PHP files in upload or staging folders deserve a closer look.
5. Follow the CISA actions
CISA's required action is to apply vendor mitigations in line with BOD 26-04 and its "Forensics Triage Requirements." It also says to follow BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. Stakeholders must assess each asset's internet exposure. Federal agencies have until 2026-11-06.
A quick decision table
Your situation | What to do |
|---|---|
Internet-facing site on 4.7 to 7.1.3 | Update to 7.1.4 today, then run the checks above |
Upgrade is scheduled but not done | Go straight to 7.1.4 instead of upgrading to an older release. That move is itself a full-package upgrade, so keep it short and cover its window in the step 3 and step 4 checks |
Internal-only site | Patch on your normal fast track and review exposure |
Signs of unknown PHP files | Isolate the host, preserve logs, and start incident response |
What learners can take from this
This bug is a classic race condition, the kind of thing that shows up in secure coding and vulnerability management topics. It also shows why patch triage depends on exposure, not only on a CVSS number. If you are building analyst skills, the CompTIA CySA+ CS0-003 voucher ($224.99) lines up with vulnerability management and response work. For a related patching story, read our post on Ivanti zero-days chained in Connect Secure.
Vouchers are emailed within 12 hours of payment and also shown in your account.
Sources
Questions about this topic
Which WordPress versions does CVE-2026-119977 affect?
WordPress Core 4.7 through 7.1.3 is affected. The fixed release is 7.1.4. Check your version with `wp core version` or on the Dashboard Updates screen.
Does an attacker need a WordPress account to exploit it?
No. The NVD vector shows PR:N, meaning no privileges are required, and the description says unauthenticated attackers can execute code. The attacker does need to act during the upgrade window, which is why complexity is rated high.
Why is the score 8.1 and not critical?
The CVSS vector has AC:H, meaning attack complexity is high. The attacker must time the attack against the upgrade window. Impact on confidentiality, integrity and availability is still rated high.
Is CVE-2026-119977 being exploited?
CISA added it to the KEV catalog on 2026-11-03, with a federal due date of 2026-11-06. Known ransomware use is listed as Unknown.
What is a TOCTOU race condition?
It happens when a program checks a resource and then uses it later, and an attacker changes it in between. The check no longer matches reality. It is tracked as CWE-367.
