WordPress Core Flaw CVE-2026-119977: Hackers Target Sites During Updates – Explained Simply

This WordPress core flaw is a rare security risk because it only exists while your site updates itself. A new WordPress core vulnerability, CVE-2026-119977, is now being targeted by attackers. The unusual part? The danger exists only for a few seconds, while your site is updating WordPress itself. The US agency CISA has added it to its Known Exploited Vulnerabilities (KEV) list, and WordPress has already released fixed versions, including WordPress 7.1.4.

WordPress powers a huge share of websites, including many Indian blogs, college sites and small business pages. So if you run a WordPress site, or want a career in cybersecurity, this story is worth five minutes. Let’s break it down in simple words.

What happened? Quick summary of the WordPress core flaw

In short, the WordPress core flaw is a timing bug in the update process.

• Product: WordPress Core (the main WordPress software, not a plugin or theme).
• Flaw: CVE-2026-119977, a race condition (TOCTOU, CWE-367) during core updates that can lead to remote code execution (RCE).
• Severity: CVSS 3.1 score 8.1 (High), as assigned by Wordfence, which acted as the CVE Numbering Authority. WordPress itself rated the issue as low.
• Login needed? No. An unauthenticated attacker can try it, but the attack is hard to time.
• Fix released: 28 October 2026 in WordPress 7.1.4, with backported fixes for older branches down to 4.7.
• Government alert: CISA added the flaw to its KEV catalogue on 3 November 2026 and gave US federal agencies until 6 November 2026 to fix it.

What is a race condition in the WordPress core flaw?

Put simply, this WordPress core flaw depends on exact timing. Imagine a bank locker room. The staff opens a locker for a few seconds to move your valuables into a new locker. If a thief already knows which locker will be opened and is standing right there, he can grab something in those few seconds.

That is a race condition. Two things happen at almost the same time, and the result depends on who is faster. TOCTOU means Time-of-Check to Time-of-Use: the system checks something is safe, but by the time it actually uses it, the situation has changed.

How does the WordPress core flaw attack work?

The WordPress core flaw attack works in a few steps. When WordPress does a full-package core update, it first unpacks the new WordPress files into a temporary staging folder inside wp-content/upgrade/. Then it copies them over the live site and cleans up.

Here is the problem, explained step by step:

1. The staging folder name was predictable, so an attacker could guess it.
2. That folder sits inside the website, so it was reachable from the internet and PHP files inside it could run.
3. The new package contains the WordPress installer file (setup-config.php). This file is meant for setting up a brand new site.
4. If an attacker reaches that staged installer before cleanup, they could potentially use it to run their own PHP code on the server.

According to Wordfence, all four conditions must line up: a full-package update, web access to the staging folder, a guessed path, and enough time before cleanup. In lab tests the folder normally stayed available for only seconds. That is why the attack complexity is rated high. But attackers can simply keep sending requests and hope to hit the right moment.

Is the WordPress core flaw CVE-2026-119977 really being exploited?

Yes, the WordPress core flaw is being exploited in the wild. Yes, attackers are actively trying it. Wordfence reported more than 18,500 requests aimed at staged installer paths in the first 21 hours after disclosure. Other security firms reported even larger numbers of blocked attempts within a day.

One important detail: these are attempts, not confirmed hacks. As of now, neither CISA nor Wordfence has publicly reported a confirmed site takeover. Still, when CISA puts a flaw on the KEV list, it means there is evidence of real-world exploitation, so it should be treated seriously.

Which versions does the WordPress core flaw affect, and which are safe?

The WordPress core flaw affects many older branches. The flaw affects WordPress core versions from 4.7 up to 7.1.3. WordPress released fixes for every branch back to 4.7. Some common safe versions are:

• 7.1 branch: update to 7.1.4 or later
• 7.0 branch: 7.0.8
• 6.9 branch: 6.9.11
• 6.8 branch: 6.8.12
• 6.7 branch: 6.7.11
• 6.6 branch: 6.6.11
• 4.6 and older: no fix. These versions no longer receive security updates – upgrade fully.

WordPress 7.1.4 also fixed 21 other security issues, mostly stored cross-site scripting (XSS) bugs. The fix for this flaw gives the staging folder a random name, keeps a guard index.php file in the upgrade folder, and stops wp-config.php from being copied out during updates. Related reading: PHP2Shell vulnerability: update PHP now.

What should you do about the WordPress core flaw?

• Check your version now: go to Dashboard → Updates. If you are not on 7.1.4 (or the fixed version of your branch), update.
• Do not assume auto-updates worked. Verify the version after updating.
• Block web access to the upgrade folder. Security researchers recommend denying direct access to wp-content/upgrade/, ideally before you update, because the update is unpacked by the old, unpatched code.
• Find forgotten sites: old staging, test or demo WordPress installs are easy targets.
• Look for signs of compromise: unknown admin users, new plugins you did not install, unexpected PHP files, and log entries for requests to wp-content/upgrade/ around your update time.
• If you suspect a hack: take a backup of the logs, clean or restore the site, and change all passwords and keys the site uses.

To handle the WordPress core flaw, act in this order. On Apache servers, a simple .htaccess file placed inside wp-content/upgrade/ can deny web access (test on your hosting first):

# wp-content/upgrade/.htaccess (Apache 2.4)
Require all denied

On Nginx, your host or server admin can add a rule like this inside the site’s server block:

location ^~ /wp-content/upgrade/ {
    deny all;
}

If you are a student or job seeker: this is a great real-life example of a race condition and of why CVSS score, attack complexity and “exploited in the wild” status all matter together. Related reading on Tank Seekers: PHP2Shell vulnerability: update PHP now.

Key takeaways on the WordPress core flaw

Remember these points about the WordPress core flaw.

• CVE-2026-119977 is a race-condition flaw in WordPress core that can lead to remote code execution during core updates.
• It is rated CVSS 8.1 (High) by Wordfence and is listed in CISA’s KEV catalogue.
• WordPress 7.1.4 (released 28 October 2026) and backported versions fix it.
• Attack attempts are widespread, but no confirmed takeover has been publicly reported so far.
• Update, verify, block wp-content/upgrade/ from the web, and check your logs.

FAQ

Quick answers about the WordPress core flaw. Tap a question to open it.

GK Practice Questions on the WordPress core flaw

Test yourself on the WordPress core flaw with these questions.

Multiple Choice Questions (MCQs)

Pick the best option for each question about the WordPress core flaw.

Q1. CVE-2026-119977 affects which software?
(a) A WordPress plugin
(b) WordPress Core
(c) PHP
(d) MySQL

Q2. What type of vulnerability is CVE-2026-119977?
(a) SQL injection
(b) Buffer overflow
(c) Race condition (TOCTOU)
(d) Phishing

Q3. What CVSS 3.1 score did Wordfence give this flaw?
(a) 5.5
(b) 7.2
(c) 8.1
(d) 9.8

Q4. Which WordPress version fixes the flaw on the 7.1 branch?
(a) 7.1.2
(b) 7.1.3
(c) 7.1.4
(d) 7.0.7

Q5. Which folder holds the temporary staging files during a core update?
(a) wp-includes/
(b) wp-content/upgrade/
(c) wp-admin/css/
(d) wp-content/themes/

Q6. What does TOCTOU stand for?
(a) Time-of-Check to Time-of-Use
(b) Type-of-Code to Type-of-User
(c) Transfer-of-Control to Transfer-of-Update
(d) Time-of-Copy to Time-of-Upload

Short Answer Questions

Answer these in one line, based on the WordPress core flaw explained above.

Q1. On which date was WordPress 7.1.4 released?

Q2. Which US agency added CVE-2026-119977 to the KEV catalogue?

Q3. Name the installer file attackers target in the staging folder.

Q4. Which CWE number describes a TOCTOU race condition?

Q5. What was the deadline given to US federal agencies to fix this flaw?

Descriptive Questions

Write longer answers about the WordPress core flaw in your own words.

Q1. Explain what a race condition is and how CVE-2026-119977 turns a short update window into a remote code execution risk.

Q2. Why can a high CVSS vulnerability with “high attack complexity” still be dangerous, and what steps should a website owner take after a core security update?

Sources