WordPress Patches Actively Exploited Core RCE Flaw CVE-2026-119977
Summary
CVE-2026-119977 is an unauthenticated RCE caused by a TOCTOU race during WordPress Core upgrades. CISA added it to KEV after evidence of exploitation; reports describe probing attempts. WordPress 7.1.4 fixes the flaw.
Key points
- The flaw affects WordPress Core versions 4.7 through 7.1.3 during full-package upgrades.
- A TOCTOU race can expose predictable, web-accessible staging files briefly; reaching the staged setup-config.php during that window may enable unauthenticated PHP code execution.
- CISA added the vulnerability to its KEV catalog after evidence of exploitation. Reported request and attempt counts do not establish successful compromise.
- Wordfence telemetry cited in the article recorded more than 18,500 requests to staged installer paths in the first 21 hours; GBHackers later reported nearly 59,000 blocked attempts in 24 hours.
- WordPress 7.1.4, released October 28, 2026, fixes the issue; fixes were also backported to eligible older branches.
- Administrators should update and verify completion, then review logs for requests to upgrade paths and check for unexpected PHP files, accounts, plugins, or configuration changes.
Article Details
- Vulnerability Types
- Time-of-check to time-of-use (TOCTOU) race condition
- Unauthenticated remote code execution
- Severity
- High (CVSS 3.1: 8.1)
- Affected Versions
- WordPress Core 4.7 through 7.1.3
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- Consider restricting direct web access to temporary upgrade directories where operationally feasible.
- Use WAF protections that inspect direct requests to staged PHP files; this is not a replacement for patching.