WordPress: a flaw in the core upgrade process is exploited to run code on servers, CISA warns

CISA added CVE-2026-119977, a race condition in WordPress core upgrades that lets an unauthenticated attacker run code on the server during the upgrade window, to its catalog of actively exploited vulnerabilities on 3 November 2026. WordPress fixed it in version 7.1.4, released on 28 October; versions 4.7 to 7.1.3 are affected.

What happened

On 3 November 2026, CISA added CVE-2026-119977, a flaw in WordPress core, to its Known Exploited Vulnerabilities catalog, confirming that it is being used in attacks. US federal agencies have until 6 November to fix it, and the entry asks them to carry out forensic triage as well. WordPress had fixed the issue in version 7.1.4, released on 28 October together with eleven other security fixes, describing it as a weakness in the upgrade process that can lead to remote code execution during the upgrade window.

How attackers get in

According to the CVE record, published by Wordfence, full-package core upgrades use staging paths that are predictable and reachable from the web. An attacker who wins the race (a time-of-check to time-of-use flaw, rated 8.1 on CVSS 3.1) can execute code on the server without any account while the upgrade is running. The record lists every branch from 4.7.0 to 7.1.3 as vulnerable. The attack is complex, but it is not theoretical: according to BleepingComputer, Wordfence reported blocking 13,095 attempts in a single 24-hour period.

What to do now

1. Check the version of each site: wp core version with WP-CLI, or Dashboard > Updates.
2. Update to 7.1.4 (wp core update). On older branches, WordPress says backported fixes are being released down to 4.7: install the latest release of your branch, and plan the move to 7.1.
3. As a precaution, block web access to the wp-content/upgrade/ directory (location ^~ /wp-content/upgrade/ { deny all; } on Nginx, Require all denied on Apache), as no visitor needs it.
4. Look for traces: run wp core verify-checksums, look for PHP files in wp-content/upgrade/, unknown administrator accounts and recently modified files, and check web logs for requests to that directory around past upgrades.

Our take

Here the update process itself was the weak point, so running updates is not enough: the window during which they run must also be protected. For business sites, apply updates in a controlled way, block web access to working directories, and check file integrity after each upgrade.

Sources

• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-119977 (WordPress Core)
• WordPress.org — WordPress 7.1.4
• CVE Program — CVE-2026-119977 record
• BleepingComputer — CISA flags WordPress RCE flaw as actively exploited in attacks

How we choose, verify and write our analyses →