CISA lists WordPress Core upgrade-window race condition CVE-2026-119977 as exploited
A race in WordPress Core full-package upgrades lets unauthenticated attackers run code in versions 4.7 through 7.1.3; CISA now lists it as exploited.
What CISA added
On 2026-11-03 CISA added CVE-2026-119977 to its KEV catalog of known exploited vulnerabilities. The entry is named “WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability” and is classed as CWE-367. Known ransomware campaign use is listed as Unknown.
The deadline is tight. For US federal civilian agencies bound by BOD 22-01, the due date is 2026-11-06, and the NVD record itself was only published on 2026-10-31. NVD lists the record’s status as Analyzed.
How the flaw works
Both the KEV entry and NVD describe the same mechanism. During a full-package core upgrade, WordPress Core uses staging paths that are predictable and reachable over the web. According to the KEV description, this “could allow unauthenticated attackers to execute code on the server during the upgrade window.”
NVD gives the affected range as versions 4.7 through 7.1.3 and calls the result Remote Code Execution. The NVD references point to the upgrade code in the 7.1.3 tag, including class-core-upgrader.php, class-wp-upgrader.php, update-core.php and setup-config.php, and to class-wp-upgrader.php and update-core.php in the 7.1.4 tag. The KEV notes link the WordPress 7.1.4 release post on wordpress.org as vendor information.
Two details matter for triage. First, the attacker needs no account: the descriptions say unauthenticated. Second, the exposure is tied to a window of time, the period while a full-package core upgrade is running, rather than to a site at rest. A site sitting on an affected version is still exposed every time such an upgrade runs.
Severity
The only CVSS score in the record is a secondary one: CVSS 3.1 base score 8.1 HIGH, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Read field by field, that is a network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity and availability.
The high attack complexity fits the description: the attacker has to act during the upgrade window, not at any moment. The KEV listing records that CISA treats the flaw as exploited regardless.
What to do
The required action is to apply mitigations in accordance with vendor instructions, following CISA’s BOD 26-04 guidance on prioritizing security updates based on risk and its “Forensics Triage Requirements”. Where mitigations are unavailable, the guidance is to discontinue use of the product, and stakeholders are responsible for evaluating each asset’s internet exposure.
For anyone running WordPress, the practical check is the core version on each site: the affected range ends at 7.1.3. The KEV notes also link a Wordfence threat-intel entry on the issue alongside the WordPress 7.1.4 release post.
Source: CVE-2026-119977 (NVD, CISA KEV)