CISA lists exploited WordPress upgrade race CVE-2026-119977
First merged summary.
CISA cataloged actively exploited WordPress core flaw CVE-2026-119977; 7.1.4 and backports fix it, but updating can briefly reopen the race.
CISA added CVE-2026-119977, an unauthenticated time-of-check time-of-use race in WordPress core upgrades, to its Known Exploited Vulnerabilities catalog. The flaw affects versions 4.7 through 7.1.3 and can allow remote code execution only while a full-package upgrade leaves predictable staging paths under /wp-content/upgrade/ web-accessible. WordPress fixed it in 7.1.4 on October 28, 2026, with backports including 6.9.11 and 7.0.8; BleepingComputer instead describes the flaw as in 7.1.4. Wordfence says probing began that day and later blocked more than 240,000 attempts, peaking above 74,000 on October 30. Federal agencies were told to patch by November 6. Installing the fix can still use the old unpatched unpacker once.
- CVE-2026-119977, CVSS 8.1, affects WordPress 4.7 through 7.1.3.
- Fixed in 7.1.4 on October 28, 2026, plus branch backports.
- Wordfence later blocked more than 240,000 attempts; early counts were about 18,500.
- Exploitation is limited to the short full-package upgrade window.
- CISA KEV date is November 2 per Wordfence and November 3 per others.
- Free Wordfence firewall rule is scheduled for November 27, 2026.
Timeline
dated events in the reporting · oldest first- Oct 28, 2026WordPress 7.1.4 released; probing began the same day. · Wordfence
- Oct 30, 2026Blocked requests peaked above 74,000; UK honeypot hit. · Cyber Security News
- Nov 2, 2026Wordfence says CISA added the flaw to KEV. · Wordfence
- Nov 3, 2026Other outlets date the CISA KEV addition. · Cyber Security News
- Nov 6, 2026Federal agencies were required to apply fixes. · Security Affairs
What each outlet adds
beyond the shared facts- WordfenceBackports, 240,000 blocks, and a November 27 free rule.
- The Hacker NewsInstalling the fix can expose sites one last time.
- Cyber Security NewsOctober 30 peak above 74,000; counts are requests, not infections.
- Qualys ThreatPROTECTQID 735969 detects vulnerable assets.
- BleepingComputer13,095 blocks in a day and BOD 26-04 deadline.
- CVEs
- CVE-2026-119977
- Products
- WordPress CoreWordfence
- Countries
- US
Coverage
oldest first · one row per article · UTC- · 6d ago
The Hacker NewsFirst report
CISA adds WordPress Core TOCTOU flaw to KEV
CISA confirms active exploitation of CVE-2026-119977 allowing unauthenticated code execution during upgrades.
- · 6d ago
Security Affairs
CISA adds WordPress flaw to KEV catalog
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog; Wordfence recorded over 18,500 exploitation attempts in 21 hours.
- · 6d ago
Cyber Security News
CISA Adds WordPress Upgrade Flaw to KEV Catalog
CVE-2026-119977 allows remote code execution via race condition during WordPress upgrades.
- · 6d ago
Qualys ThreatPROTECT
CISA Adds WordPress Core Vulnerability to KEV Catalog
CVE-2026-119977 TOCTOU race condition enables unauthenticated remote code execution during upgrades.
- · 6d ago
GBHackers
CISA adds WordPress code execution vulnerability to KEV catalog
CVE-2026-119977 allows unauthenticated code execution during WordPress upgrades and is actively exploited.
- · 6d ago
BleepingComputer
CISA flags WordPress RCE flaw as actively exploited in attacks
CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.
- · 5d ago
Wordfence
Attackers probe WordPress upgrade-window RCE, CVE-2026-119977
Wordfence blocked over 240,000 attempts; CISA added the flaw to KEV on November 2.
- · 4d ago
WordPress core flaw draws 240,000 exploit attempts (CVE-2026-119977)
Wordfence blocked the probes; counts are requests, not confirmed infections or sites compromised.
- · 4d ago
WordPress update race exposes sites to exploited CVE-2026-119977
WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.
- · 3d ago
WordPress Core RCE Vulnerability Allows Unauthenticated Remote Code Execution
Attackers exploit race condition in WordPress Core upgrades for unauthenticated RCE on versions 4.7 to 7.1.3.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | 1% | KEVPoC ×7 | KEV |