WordPress Core Updater Race Condition Enables Unauthenticated Code Execution
Summary
CVE-2026-119977 lets unauthenticated attackers exploit a race in WordPress core updates to expose a temporary installer and, under specific conditions, execute PHP code. WordPress 7.1.4 fixes the flaw; CISA added it to KEV.
Key points
- The flaw lets an attacker create a configuration file through a temporary, web-accessible installer during a core update; the updater may then copy it over the live wp-config.php.
- The article says exploitation can lead to administrator creation and PHP code execution, with exposure depending on package contents and whether the staging path is predictable.
- WordPress 2.7.0 through 7.1.3 are affected by the underlying updater behavior; WordPress 7.1.4 fixes the issue, with fixes backported to maintained branches down to 4.7.
- The first update to a fixed release retains risk: the old updater may leave the temporary installer reachable, although the new update code prevents the staged wp-config.php from replacing the live one.
- Recommended precautions include blocking HTTP access to wp-content/upgrade/ during the update or manually installing outside the web root; WP-CLI uses the same updater.
- The article reports that CISA added CVE-2026-119977 to its KEV catalog on November 3, 2026, citing active exploitation.
Article Details
- Vulnerability Types
- Race condition
- Unauthenticated remote code execution
- Severity
- CVSS 8.1
- Affected Versions
- WordPress 2.7.0–7.1.3 (exposure depends on qualifying update-package contents and staging-path predictability)
- Exploitation Status
- active
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- Block web access to wp-content/upgrade/ before updating.
- Manually update by extracting the release outside the web root and copying the core files into place while leaving wp-config.php and wp-content untouched.
MITRE ATT&CK
T1136.001 · Local AccountAfter the vulnerable update exposes the installation workflow, the attacker can create the first administrator account in the replacement database.T1190 · Exploit Public-Facing ApplicationAn unauthenticated attacker sends requests to the temporary setup-config.php endpoint exposed under wp-content/upgrade/ to exploit the updater race condition.
CVE
Vendors
Products
Picus PlatformWe strongly suggest simulating CVE-2026-119977 attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform.WordPressDuring my security research at Picus Security, I discovered a race condition in the WordPress core updater that can allow an unauthenticated attacker to replace a site’s live wp-config.php during a core update.