Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-11051 | Publication Date: 05 November 2026

Critical Remote Code Execution During WordPress Core Updates
CVE-2026-119977

Summary

A high-severity vulnerability has been identified in WordPress Core that allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) during the core upgrade process. The vulnerability is tracked as CVE-2026-119977 and has been assigned a CVSS v3.1 score of 8.1 (High).

This issue is being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 3 November 2026. Organizations and site owners running self-hosted WordPress installations are strongly advised to update immediately.

Technical Overview

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) in the WordPress core updater. During a full-package core upgrade, WordPress extracts the update package into predictable, web-accessible staging directories (typically under wp-content/upgrade/). An attacker who can reach these temporary paths during the brief upgrade window can interfere with the process, potentially replacing critical files such as wp-config.php or executing arbitrary code.

The attack window is short (often only a few seconds in laboratory conditions), which is why WordPress initially rated the issue as Low. However, the combination of unauthenticated access, widespread deployment of WordPress, and high-volume scanning has made the vulnerability practically exploitable. Wordfence (the CNA) assigned the higher CVSS score of 8.1 reflecting the real-world impact.

Successful exploitation can lead to full site compromise, including the ability to create administrator accounts, install malicious plugins, or execute arbitrary PHP code on the server.

Affected Systems

WordPress Core versions from 4.7 through 7.1.3 are affected. Fixed versions have been released for all supported branches:

• WordPress 7.1.x → 7.1.4
• WordPress 7.0.x → 7.0.8
• WordPress 6.9.x → 6.9.11
• WordPress 6.8.x → 6.8.12
• And corresponding security releases backported to branches down to 4.7

Sites running unsupported versions (4.6 and earlier) should upgrade to a currently supported branch.

Exploitation Status

• Active exploitation confirmed and added to CISA KEV on 3 November 2026.
• Federal civilian agencies required to remediate by 6 November 2026.
• High-volume probing of staging installer paths observed by security vendors shortly after disclosure.
• Public proof-of-concept material and exploit attempts are circulating.

Recommendations

1. Immediate Action: Update all self-hosted WordPress installations to the latest fixed version of your branch (preferably 7.1.4 or the equivalent security release for your line) as soon as possible.
2. When performing the update, consider temporarily restricting public access to the wp-admin and wp-content/upgrade directories (via firewall, web server rules, or maintenance mode) to reduce the attack window.
3. After updating, review the file system for unexpected PHP files, especially in wp-content, wp-includes, and the root directory. Check for unauthorized administrator accounts.
4. Review web server and WordPress logs for unusual requests targeting upgrade or setup-config paths around the time of any recent updates.
5. Ensure automatic updates are enabled where operationally feasible, and monitor for future security releases.
6. If compromise is suspected, follow incident response procedures: take the site offline if necessary, perform forensic review, rotate all credentials and secrets, and restore from a known-clean backup if required.

Given WordPress’s prevalence and the confirmed active exploitation, this vulnerability should be treated as a high-priority risk for any internet-facing self-hosted installation.

Karen IT
We make the Internet harder to abuse.