Exploited WordPress core flaw CVE-2026-119977 lets attackers run code during core upgrades
Attackers with no login can run code on the server while a full core upgrade is in progress. Every branch from 4.7 now has a fixed release.
Affects
WordPress Core
What to do
Update every WordPress site to 7.1.4 today, then check each for files and accounts nobody added.
- KEV listed
- CVE
- CVE-2026-119977
- CVSS
- 8.1 (v3.1, Wordfence, via NVD)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- WordPress Core 4.7 through 7.1.3
- Fixed in
- WordPress 7.1.4
- WordPress 7.0.8
- WordPress 6.9.11
- WordPress 6.8.12
- Branches 4.7 to 6.7: the fixed release NVD lists for each, 4.7.39 to 6.7.11
How the flaw works
WordPress stages files at predictable, web-accessible paths during a full-package core upgrade. An unauthenticated attacker who reaches those paths during the upgrade window can execute code on the server. Each full core upgrade on an unpatched site opens that window.
What to do now
Sites with automatic background updates turned off go first, then any site held on an older branch, which needs the fixed release for that branch.
- List every WordPress site the firm runs, including staging and campaign sites, with its core version
- Update each from Dashboard, Updates, Update Now, or confirm the automatic update has completed
- Restrict the site to your own addresses while the core upgrade runs, where hosting allows
- Move sites on older branches to the current release, the only one WordPress actively supports
- Compare core files against a clean copy of the release and investigate anything extra
Who is affected
Any site on an affected version is exposed while a full-package core upgrade runs, because the upgrade uses predictable, web-accessible staging paths. WordPress backported the fix to every branch from 4.7, and the NVD record names the fixed release for each, such as 6.9.11 and 7.0.8. The same release fixes several stored cross-site scripting flaws.
Detection notes
The window opens only during an upgrade, so start from the time of each core upgrade and read the web server logs either side of it.
- Requests from outside addresses to upgrade staging paths while a core upgrade ran
- PHP files in the site that match no plugin, theme or core release
- Administrator accounts or plugins nobody on the team added
- Outbound connections from the web server to addresses it has no reason to reach
Essential Eight mapping
Patch applications: the Essential Eight Maturity Model sets 48 hours for internet-facing services where a working exploit exists, and this flaw is exploited. Restrict administrative privileges and multi-factor authentication: keep WordPress administrator accounts few and protected, so an account an attacker plants stands out.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.11.03)Retrieved 4 Nov 2026
- PrimaryWordPress.org, WordPress 7.1.4 security release (October 2026)Retrieved 4 Nov 2026
- PrimaryNVD, CVE-2026-119977 (published 31 October 2026)Retrieved 12 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
