WordPress CVE-2026-119977: Core Update RCE Exploited

WordPress CVE-2026-119977 is a race condition in WordPress Core updates that lets an unauthenticated attacker run code on the server during the brief window while a full-package core upgrade is being extracted. It affects WordPress 4.7 through 7.1.3, carries a CVSS score of 8.1, and CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026. Update to WordPress 7.1.4, or the patched release on your branch, now.

The flaw sits in how WordPress stages a complete core package during an upgrade. According to the WordPress security advisory, WordPress extracted the new files to a predictable directory inside the web-served upgrade folder. An attacker who requests the staged installer files at the right moment can reach them before the upgrade finishes and turn that into remote code execution. No account on the site is needed. The catch is timing: the attacker has to win a race against an update that is actually running, which is why NVD scores the attack complexity as high.

That has not stopped attackers from trying at scale. Wordfence reported more than 18,500 requests targeting staged "setup-config.php" installer paths in the first 21 hours after disclosure, and said it blocked 12,632 exploitation attempts in a single 24-hour period, according to The Hacker News. Previdian separately recorded exploitation attempts against its honeypots on October 30. CISA then confirmed active exploitation and gave federal agencies until November 6, 2026 to patch, per the CISA KEV catalog.

How does the WordPress core upgrade race condition work?

CVE-2026-119977 is a time-of-check time-of-use flaw (CWE-367). During a full-package update, WordPress unpacks the new release into a predictable, web-accessible staging path before moving it into place. For a short time, installer files from the fresh package are reachable over HTTP. If an attacker requests them in that window, the installer runs in a state the site owner never intended, which is the opening for code execution. Attackers do not know when your site will update, so the practical attack is to probe staging paths continuously and wait for an update to land. Automatic background updates make that window predictable across many sites at once.

Which WordPress versions are affected and fixed?

The WordPress 7.1.4 release also fixes a batch of stored cross-site scripting issues, including two reported by Anthropic. Because the fix was backported, a site does not need to jump to the 7.1 branch to be safe. It needs the latest security release on whatever branch it runs.

How do you check whether your WordPress site was targeted?

Start with your web server access logs. Requests for installer paths such as setup-config.php inside the upgrade folder, especially around the time a core update ran, are the signal Wordfence and Previdian saw. Then confirm the running version under Dashboard, Updates, or with WP-CLI using wp core version. If a site updated while it was exposed and you find hits on staged installer paths, treat it as possibly compromised: look for new administrator accounts, unfamiliar PHP files in wp-content and the upgrade folder, and changed wp-config.php values, and rotate database and salt keys. A web application firewall rule that blocks direct requests to the upgrade directory is a reasonable stopgap, but it does not replace the patched release.

Our read

The EPSS score here is a modest 0.6%, yet CISA has confirmed exploitation and Wordfence counted thousands of attempts a day. That gap is the point. A probability model trained on past exploitation cannot see a brand-new, cheap-to-spray bug on the most widely deployed CMS on the web until the attacks are already underway. The honest signal was the combination: no authentication, a huge install base, and a public description of the staging path. This is also an attack that only exists while your system changes state, during an update, which a once-a-year test will almost never catch. Testing the live, internet-facing path continuously is what surfaces this kind of window. For how to weigh EPSS against confirmed exploitation, see our guide to prioritizing vulnerabilities with CVSS, EPSS and KEV and what the CISA KEV catalog is. For other recent WordPress bugs, see our coverage of the wp2shell RCE and the Forminator unauthenticated upload flaw. To test what an attacker can reach on your own sites, Nexus Void runs VAPT on web apps, APIs and mobile apps.

Reporting by The Hacker News; advisory from WordPress; CVSS, EPSS and KEV dates per NVD, FIRST and the CISA KEV catalog.