> ## Content Index > Fetch the complete content index at: https://stackurity.ai/blog/llms.txt > Use this file to discover other available public pages before exploring further. # WordPress CVE-2026-119977: exploited upgrade race condition, how to mitigate - URL: https://stackurity.ai/blog/wordpress-core-cve-2026-119977-exploited-upgrade-race-condition/ - Published: 2026-11-04T02:05:09.000Z - Updated: 2026-11-04T02:05:09.000Z - Description: CISA lists WordPress Core CVE-2026-119977, an upgrade race condition, as exploited. See affected versions, how to check a site and how to mitigate. - Author: Stackurity Research Team - Tags: Actively Exploited, #deep-dive ## TL;DR - **What:** CVE-2026-119977 is a race condition of the check-then-use kind in WordPress Core, described as affecting versions 4.7 through 7.1.3. - **Impact:** a remote attacker with no login could get code running on the server while an upgrade is in progress, through predictable, web-accessible staging paths. - **Severity:** a CVSS v3.1 score of 8.1 from Wordfence, rated high. - **Exploited:** yes. CISA added it to its Known Exploited Vulnerabilities catalogue on November 3, 2026, with a federal due date of November 6, 2026. - **Fix:** update WordPress to the release the vendor announced. The records we reviewed give no fixed version, so use the vendor's release announcement linked below. ## What the vulnerability is WordPress can upgrade itself. When it applies a full-package core upgrade, it unpacks new files into a staging area before it swaps them in. CVE-2026-119977 is a race condition in that process. The staging paths are predictable and can be reached over the web, so a visitor who knows where to look can step in while the upgrade is running. NVD's description says an attacker with no login can get the server to run their code during that window. The weakness class is CWE-367\. In plain English: the software checks something at one moment and relies on it a moment later, and an attacker who can act in between gets to change the outcome. Here the thing that can be tampered with is the staged installer. The NVD entry was published on October 31, 2026\. NVD had not finished its own analysis when we read it, so the CVSS v3.1 base score of 8.1 comes from Wordfence, the party that supplied the score. The attack complexity is rated high, which fits a race condition: the attacker has to hit a narrow window. ## Why it matters now CISA added the flaw to the Known Exploited Vulnerabilities catalogue on November 3, 2026\. That catalogue lists vulnerabilities with evidence of exploitation, and a listing turns a theoretical race into a work item. The federal due date is November 6, 2026, and CISA tells agencies to apply vendor mitigations under its BOD 26-04 guidance and to follow its forensics triage requirements. Even if you are not a federal agency, the same logic applies: public sites that update themselves are exactly the sites an attacker can scan for. Two things make this one worth a quick look. First, WordPress sites are everywhere in an estate, often owned by marketing or an agency rather than by the platform team, so nobody has a complete list. Second, the exposure is tied to an event you cause yourself. Automatic background updates and manual upgrades both open the window, so a site that updates often has more windows than one that never does. If you run a commerce site on WordPress, the consequence of code execution is not limited to the blog: it reaches the order data and customer details the server can read. We covered an earlier [report of a WordPress race condition under attack](https://stackurity.ai/blog/wordpress-race-condition-rce-attempted-exploitation/), and this entry gives it a CVE and a catalogue listing. ## Am I affected? NVD describes the affected range as WordPress Core from 4.7 through 7.1.3\. Any site below the fixed release should be treated as in scope. To check one site by hand, read the version from the site directory: - `wp core version` prints the installed version if you use WP-CLI. - `grep wp_version wp-includes/version.php` reads it straight from the file. - In the admin dashboard, the version is shown on the Updates screen. Hosting providers sometimes patch WordPress for you or manage upgrades centrally. If yours does, ask them which release is deployed and when the staging area is exposed, rather than assuming. Note that a managed or containerised site may run a different copy than the one on your server, so check every place WordPress is deployed, including images and staging environments. ## How to mitigate CVE-2026-119977 1. Read the vendor's [WordPress release announcement](https://wordpress.org/news/2026/10/wordpress-7-1-4/) and note the version that fixes the flaw. We do not repeat a number here because the records we reviewed do not state it, so take it from the vendor. 2. Take a backup of the files and the database for each site before you touch it, so you can roll back if the upgrade fails midway. 3. Upgrade core to that release, ideally in a maintenance window with public traffic limited, so the staging paths are not exposed while the upgrade runs. With WP-CLI the command is `wp core update`. 4. Confirm the new version with `wp core version`, then check that the site loads and that no unexpected files or administrator accounts appeared. Because this flaw is exploited, review web server logs from the days around past upgrades for requests you do not recognise, and follow CISA's forensics guidance where it applies to you. 5. If you cannot upgrade immediately, avoid starting a core upgrade on a public site until you can limit access to it, and keep automatic core updates under your control rather than leaving them to run unattended. ## How to check with Stackurity Stackurity finds WordPress sites as applications from wp-config.php or wp-includes/version.php on Linux servers and in images, and it reports the WordPress core version. A site that is behind its release line's latest release gets a finding that names the update, and a release line that no longer gets security releases becomes an end-of-life finding. That makes it a practical way to see, across every server, which sites still run an old core and need the upgrade above. Be clear about the limit: vulnerabilities in WordPress core itself are not matched yet, so Stackurity will not raise this CVE as its own finding. Composer-managed installs such as Bedrock get no core version, and Stackurity does not cover appliance firmware. After you upgrade, check again asks the agent for a fresh report and records whether the finding is passed, partly fixed or still open. The [remediation documentation](https://stackurity.ai/docs/remediation) explains how fixes are tracked. Stackurity Cloud has a 14-day free trial without a card: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=wordpress-core-cve-2026-119977-exploited-upgrade-race-condition). ## FAQ ### Is CVE-2026-119977 being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalogue on November 3, 2026, which means exploitation in the wild is on record. CISA lists whether it is used in ransomware campaigns as unknown. ### Which WordPress versions are affected? The NVD entry says WordPress Core from 4.7 through 7.1.3\. Read the vendor's release announcement for the release that carries the fix, because the sources we reviewed do not name one. ### Does a site need to be mid-upgrade to be attacked? The flaw is a race condition around upgrades: the attack needs the site to be running a full-package core upgrade, when predictable staging paths are reachable over the web. Outside an upgrade, the described attack path is not available, but an unpatched site will meet the same risk at its next upgrade. ### Does Stackurity match this vulnerability in WordPress core? Not yet. Stackurity finds WordPress sites, reports the core version and flags a site that is behind its release line's latest release, but it does not match vulnerabilities in WordPress core itself. Use that version finding to drive the update, and confirm the fix by hand. Sources: [CISA Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search%5Fapi%5Ffulltext=CVE-2026-119977), [NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-119977).