CVE-2026-119977 entered the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026, according to the CISA alert. The flaw is a time-of-check/time-of-use (TOCTOU) race condition in the WordPress core upgrade path and can lead to remote code execution in a narrow window during a full-package update. The fix shipped on October 28 in WordPress 7.1.4, with backports through the 4.7 branch.
Up front: this article covers impact, patch status and primary sources — not exploit steps. Operators should patch and review logs, not reproduce attacks.
CVE-2026-119977: what CISA and WordPress say
CISA lists the CVE as a “WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability” and cites evidence of active exploitation as the reason for the KEV addition. Federal Civilian Executive Branch agencies must follow Binding Operational Directive 26-04 timelines; reporting around the alert points to a Friday deadline after listing (November 6). CISA also urges non-federal organizations to prioritize KEV entries.
WordPress’s October 28 security release describes a race condition during core updates that can lead to remote code execution and credits reporter Umut Bayram. The project recommends updating sites immediately. The Version 7.1.4 documentation lists the fix among other security patches and notes backports such as 7.0.8 and 6.9.11 for older branches.
BleepingComputer summarized on November 4 that exploitation relies on predictable, web-accessible staging paths during full-package upgrades and is treated as high complexity. Wordfence is quoted as blocking 13,095 attacks targeting the flaw in 24 hours. CISA’s alert does not detail how many successful compromises occurred.
Affected versions and patch status
Wordfence and independent write-ups describe WordPress roughly from 4.7.0 through 7.1.3 as affected; fixed releases include 7.1.4 and the matching security releases on older branches. WordPress 4.6 and earlier no longer receive security updates and should move to a supported line. Sites with automatic background updates should still verify in the dashboard that 7.1.4 (or the correct backport) is actually running.
Per Wordfence’s description of the fix: randomize the staging directory, add an index guard, and block unsafe promotion of staged configuration data. Unpatched sites reopen a window on every full-package update — including the update to the fixed release itself, if an attacker times that moment.
What operators should do — without exploit detail
Priority 1: update to 7.1.4 or your branch’s backport, then verify the version. Priority 2: review web-server logs for unusual PHP requests under wp-content/upgrade and check for unknown admins, plugins or PHP files. Priority 3: firewall rules can reduce exposure but do not replace the core patch — Wordfence stresses Extended Protection because some requests hit PHP files directly without fully loading WordPress.
If you are unsure whether the site was hit while unpatched, keep backups and an incident playbook ready instead of “just updating again.” Compromised instances often need a rebuild rather than in-place cleanup — a pattern we have already seen in other actively exploited WordPress cases.
Context among other active WP/PHP flaws
At code404zero we recently covered similar update and exploit-pressure patterns: plugin issue CVE-2026-81648 in CryptoPayment Gateway, the critical PHP series around PHP2Shell, and the emergency-patch context for two RCE bugs scored CVSS 9.2. Core topics such as the SQL-mode change in WordPress 7.2 also show how operational details in core affect security and data integrity.
Unlike many plugin CVEs, this race condition sits inside the updater itself. Patching is therefore not “when we have time” — it is part of every core update process. Public exploit interest and firewall telemetry raise pressure whether or not your site has already been hit.
Severity without the hype
Wordfence rates the upgrade-window RCE at CVSS 8.1 (High); WordPress release notes often describe race conditions of this class more conservatively. CISA prioritizes via KEV status and evidence of exploitation, not marketing headlines. For operators the combination matters: unauthenticated, core updater, active attempts, clear patch.
High complexity does not mean “ignore.” It means attackers must hit timing and reachability of staging paths. Automated scanners and opportunistic actors probe exactly those windows at scale — the block counts Wordfence cites fit that pattern.
For hosts and agencies, inventory matters: which sites are still on 7.1.3 or an older branch without the backport? Automatic updates can fail when file permissions, disk space or a custom upgrader get in the way. A one-time version check across the fleet prevents treating “we have auto-updates” as “we are patched.”
What remains open
CISA’s alert gives no attribution and no detailed campaign narrative. Publicly it remains unclear how many sites were successfully compromised versus how many attempts firewalls see. Operators should not wait for “confirmed compromise here” before checking patch status.
Bottom line: CVE-2026-119977 is patched, listed in the KEV catalog and affects the WordPress core updater. Primary sources are CISA’s November 3 alert, the WordPress 7.1.4 documentation from October 28, and reporting on exploitation attempts. If you are still below 7.1.4 or without the backport, update now and review upgrade paths in the logs — without reproducing the flaw.
