WordPress Core Upgrade-Window Race Flaw (CVE-2026-119977)

CVE-2026-119977 sits in the way WordPress core stages files during a full-package upgrade. The CVE record says the staging paths are predictable and web-accessible. That makes it possible for an unauthenticated attacker to execute code on the server during the upgrade window.

The record files the weakness under CWE-367, a time-of-check time-of-use race condition. Put simply, the server checks a staged file at one moment and uses it at a later one, and an attacker can act in between. Wordfence, the CNA, scores it CVSS 3.1 8.1 High with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The High attack complexity reflects the race an attacker has to win.

What WordPress Changed in 7.1.4

The WordPress.org release documentation does not name the CVE id. Its entry that matches this flaw reads "a race condition during core updates that could lead to remote code execution", reported by Umut Bayram. CISA's KEV entry links the 7.1.4 announcement.

The CVE record links the 7.1.3 and 7.1.4 versions of class-wp-upgrader.php and update-core.php, so a reader can compare the two. The documentation lists both files among those revised in 7.1.4.

The same release fixes 21 other issues, mostly stored cross-site scripting. Our post on the WordPress 7.1.4 security update covers those and the exploitation attempts Wordfence reported.

What CISA Says About Exploitation

CISA added the CVE to the Known Exploited Vulnerabilities catalog on 3 November 2026, with a due date of 6 November 2026. Its entry marks known ransomware campaign use as Unknown and forensic triage as Yes. The required action tells owners to apply mitigations per vendor instructions under CISA's BOD 26-04. Our KEV glossary entry explains the catalog.

CISA's SSVC entry in NVD marks the flaw as not automatable. The remote code execution glossary entry explains what code execution gives an attacker once the race is won.

What Wordfence Reports About Probing

Update, 6 November 2026. Wordfence published attack data on 5 November 2026. It says "our records indicate that attackers started targeting this vulnerability on the same day it was disclosed", 28 October 2026. Its firewall has blocked over 240,000 exploit attempts.

Wordfence says the highest volume came between 29 October and 1 November 2026, peaking on 30 October with over 74,000 attempts blocked in a single day. It says most of these requests are likely automated attempts sent to the predictable staging path in the hope of reaching a site during a core upgrade.

The blocked count, Wordfence says, "does not mean that a large number of sites have been successfully exploited". It calls successful exploitation "difficult in practice" because a request only succeeds if it arrives during the short upgrade window. Wordfence advises updating to 7.1.4 or the patched release for your branch, and optionally blocking PHP files in the upgrade directory at the web server level before updating.

The CVE record lists WordPress Core from 4.7.0 through 7.1.3, as 25 branch ranges. NVD copies the same ranges from the CNA and shows the entry as undergoing analysis, last modified on 4 November 2026. Each range ends one patch release before the fixed version on the matching branch.

The fixed releases come from the WordPress 7.1.4 documentation, which lists a security release for every branch from 4.7 to 7.0 next to 7.1.4. WordPress says only its most recent version is actively supported, and 4.6 and earlier get no security updates. The CVE record names no fixed version, so the fixed column is the next patch release after each affected range.

The record does not say how a site gets exposed outside an upgrade, and the description limits the attack to the upgrade window. We recommend checking the installed version after any automatic update rather than assuming it finished. Our vulnerability management guide covers how to track a rollout like this.

A different WordPress risk sits in plugins. Security For WooCommerce admin account flaw CVE-2026-100109 lets unauthenticated visitors create administrator accounts.