WordPress CVE-2026-119977 Exploited: Core Update Race Can Lead to Code Execution, Fixed in 7.1.4

CISA added CVE-2026-119977, a race condition in WordPress core updates, to its Known Exploited Vulnerabilities catalogue on 3 November, giving US federal agencies until 6 November to act. During a core update, an unauthenticated attacker who wins the race can run code on the server. Every release from 4.7 through 7.1.3 is affected.

How the race works

WordPress's own advisory says that during an update from a complete package it "extracted the new files to a predictable directory" inside the web-served upgrade folder. An attacker who reaches those files before they are moved and cleaned up gets code execution. The project rates the issue Low; the CVE record, assigned by Wordfence, scores it 8.1 under CVSS 3.1, with high attack complexity.

Security firm ThreatDefence says the target is the staged copy of the installer, setup-config.php, and lists the conditions an attack needs: a full-package core update, a wp-content/upgrade folder that serves PHP over the web, a path the attacker can predict and enough time before the temporary files go.

What exploitation looks like

ThreatDefence cites Wordfence firewall data: more than 18,500 requests for staged installer paths in the first 21 hours after Wordfence's rule went out on 28 October. The firm stresses that "these are attempts the Wordfence firewall blocked, not confirmed compromises." CISA hasn't said what evidence put the flaw in its catalogue, and its entry marks ransomware use as unknown.

The flaw is unrelated to the Brotli bug that reaches WordPress through pingbacks, which needs a server library update rather than a WordPress one.

Fixed versions

WordPress 7.1.4, released on 28 October, fixes it, and sites with automatic background updates get it without action. The advisory lists the backports:

• 7.x: 7.1.4 and 7.0.8.
• 6.x: 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16 and 6.0.18.
• 5.x: 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28 and 5.0.31.
• 4.x: 4.9.35, 4.8.34 and 4.7.39. WordPress 4.6 and older no longer receive security updates.

Because the vulnerable moment is the update itself, ThreatDefence advises sites without a firewall rule to deny web access to wp-content/upgrade first, then update. CISA's catalogue entry also requires federal agencies to check affected systems for compromise.