CVE-2026-119977 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-31

Added to CISA KEV: 2026-11-03 3 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — IMMEDIATE PATCHING: Upgrade all WordPress installations to version 7.1.4 or later immediately. This is the only complete remediation. Enable WordPress auto-updates if not already active.
TEMPORARY MITIGATION: If immediate upgrade is not possible, configure the web server (Apache/Nginx) to deny direct HTTP access to WordPress temporary/staging directories used during upgrades (typically within wp-content/upgrade/ and similar paths). Block web access to these directories via .htaccess or server config.
UPGRADE WINDOW HARDENING: When performing WordPress core upgrades, consider placing the site in maintenance mode and restricting public HTTP access to the site during the upgrade window (e.g., IP allowlist, WAF rules). This eliminates the attack window.
MONITORING: Review web server access logs for unexpected HTTP requests to WordPress staging/upgrade directories (e.g., wp-content/upgrade/, wp-admin/includes/) during or immediately after any upgrade events. Look for POST requests or file execution attempts in these paths.
INDICATOR OF COMPROMISE: Check for unexpected PHP files in temporary WordPress directories, especially in wp-content/upgrade/, /tmp/, or any directory configured as a staging path. Look for new or modified PHP files with recent timestamps coinciding with upgrade events.
WAF RULES: Deploy or update Web Application Firewall rules to detect and block requests targeting WordPress upgrade staging directories. Cloud WAF providers (Cloudflare, AWS WAF, Sucuri) may release specific rules for this CVE.
INVENTORY: Enumerate all WordPress instances in your environment, including staging/development sites that may be internet-accessible. All must be patched regardless of traffic levels.
PATCH PRIORITY: CRITICAL — treat this as P1/emergency patching given unauthenticated RCE on the world's most widely deployed CMS. Prioritize public-facing production sites first, then staging environments.

🔍 Web Intelligence (Kagi · 2026-11-03)

Summary

CVE-2026-119977 is a critical security vulnerability in WordPress Core (versions 4.7 through 7.1.3) characterized by a time-of-check to time-of-use (TOCTOU) race condition and improper file handling during the full-package upgrade process ^[2]^[5]. The vulnerability occurs because WordPress uses predictable, web-accessible directories as staging paths while updating; this allows an unauthenticated attacker to place malicious files into these directories during the update "window" and subsequently trigger their execution ^[1]^[2]. This matters significantly because it enables remote code execution (RCE) on the underlying web server, potentially leading to a complete system compromise ^[1]^[2].

Exploitation

Active Exploitation: While security researchers have demonstrated the feasibility of the exploit, specific details regarding widespread active exploitation in the wild remain part of ongoing threat monitoring ^[3]^[4].
Threat Actors/Campaigns: There are no publicly attributed ransomware campaigns or specific threat actors linked to this CVE at this time.
PoC Availability: Proof-of-concept research and "retro-hunting" methodologies have been published, making it possible for attackers to develop functional exploits ^[3]^[6].
Attack Prerequisites: The attack is network-exploitable, does not require authentication, and does not necessitate user interaction, though it must be precisely timed to coincide with the WordPress core update process ^[1]^[2].

Affected Products & Patches

Affected Versions: WordPress Core versions 4.7 through 7.1.3 are vulnerable ^[1]^[2].
Patches: Users should upgrade to WordPress version 7.1.4 or later, which addresses the race condition and staging directory security ^[3].
Mitigations: In environments where immediate upgrading is not possible, ensure web server configurations restrict access to staging/temporary directories used by the WordPress update process.

Impact

Access/Capability: Successful exploitation grants the attacker remote code execution (RCE) capabilities with the privileges of the web server user ^[2].
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it allows unauthenticated actors to potentially steal sensitive database credentials, modify application content, pivot into the internal network, or deploy persistent backdoors ^[1].

Sources

CVE-2026-119977 | Tenable®
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. ... Word…
CVE-2026-119977 - Vulnerability Details - OpenCVE
WordPress Core versions 4.7 through 7.1.3 leak predictable, web‑accessible staging directories during full‑package upgrades, enabling attackers to place malicious payloads into these directories and then trigger their execution without authentication; the weaknesses are classified as CWE-367 and CWE…
WordPress 7.1.4 Upgrade-Window RCE: Hunting CVE- ...
CVE-2026-119977 lets attackers run code while WordPress unpacks a core update. Fixed versions, log searches, a retro hunt per site and ...
CVE-2026-119977: versions 4.7 Remote Code Execution (RCE) - Analysis ...
To protect against CVE-2026-119977, you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation. When was CVE-2…
CVE-2026-119977 – Unauthenticated RCE (Upgrade ...
CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367) in WordPress Core that can lead to remote code execution.

🔴 CVE-2026-119977