WordPress update race exposes sites to exploited CVE-2026-119977
Original title: Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.
Some WordPress sites remain exposed while installing fixes for CVE-2026-119977. The update that installs the fix still unpacks its files using the site's old unpatched code. An attacker striking at the right moment can run code on the server. The flaw affects WordPress 4.7 through 7.1.3; fixed in 7.1.4 and matching updates back to 4.7. CISA added the flaw to its KEV catalog earlier this week.
Unconfirmed: Public exploit code exists but unverified on affected versions
- CVE-2026-119977 actively exploited
- Affects: WordPress 4.7-7.1.3
- Fixed: 7.1.4 and branches
- Risk window during update
- Block wp-content/upgrade folder
Impact: remote code execution during update
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | 4.7 through 7.1.3 | 7.1.4 and matching updates back to 4.7 |
- 1.Block web access to wp-content/upgrade folder
- 2.Perform manual update outside web root
- 3.Update to 7.1.4 or branch equivalent
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | 1% | KEVPoC ×7 | KEV |
From the original article
5 min read at thehackernews.com
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.