CVE-2026-119977: WordPress core upgrade race condition gives unauthenticated attackers remote code execution — actively exploited, patch by November 6

CoeLab Real-World Impact: 85/100 — Urgent. Editorial score v1.0. Evidence checked 2026-11-04T10:10:29.565208+00:00. CVSS and EPSS are separate measures, not this editorial score.

Rating breakdown: exploitation: 30, reachability: 20, consequences: 20, operational relevance: 15.

Who is affected

CVE-2026-119977 affects WordPress core versions 4.7.0 through 7.1.3, which in practice means every WordPress release made over roughly the past decade. The vulnerability is a time-of-check to time-of-use (CWE-367) race condition in how WordPress stages files during full-package core upgrades, and it does not depend on any plugin, theme, or hosting configuration — only on running an affected core version and having an upgrade window occur.

The fix shipped in WordPress 7.1.4, released October 28, 2026. WordPress also backported the fix to all branches eligible for security fixes (currently back through 4.7); branch releases such as 7.0.8 and 6.9.11 carry it, with remaining backports shipping as they become ready. Any site still on 7.1.3 or an older branch release without the corresponding backport is considered affected. Sites with automatic background updates enabled likely have already received 7.1.4, but verifying the actual running version matters: automatic updates are not instant and can be disabled or delayed intentionally.

The CNA is Wordfence, and the issue was disclosed October 28, 2026, credited to Umut Bayram. The CVE record was published October 31 and last updated November 3, when CISA's ADP enrichment confirmed active exploitation status.

Real-world impact and exploitation evidence

The impact ceiling is remote code execution: an attacker who wins the race can execute arbitrary code on the web server during a core upgrade. From an unauthenticated starting point with no user interaction required, that is close to a worst-case outcome — code execution is the pivot that turns a defaced site into server compromise, backdoors into hosting account contents, and lateral movement to anything the hosting environment can reach. The published CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) reflects high confidentiality, integrity and availability impact across the board.

The evidence of real exploitation is unusually strong for a CVE this young. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on November 3, 2026, flagged as Active exploitation, with a federal remediation due date of November 6, 2026, and forensic triage requirements attached — meaning CISA expects agencies to assume compromise and review evidence, not merely patch. CISA's SSVC decision record marks exploitation as active, the vulnerability as not automatable, and technical impact as total. EPSS currently reads about 0.006 (a moderately low probability score as of November 3), which is a useful reminder that community scoring can lag KEV confirmation; the KEV designation is the direct, dated evidence here.

One honest nuance: CISA's KEV entry describes the bug as a TOCTOU race condition while the CNA description emphasizes predictable, web-accessible staging paths during the upgrade window. These are the same mechanism viewed from two angles — the staged files land at predictable web-reachable locations, and a mismatch in when checks happen versus when files are used lets an unauthenticated request land attacker-controlled content during the window. Nothing published so far indicates malware family attribution or ransomware association; known ransomware campaign use is listed as Unknown.

Attack prerequisites

The attack does not require credentials, user interaction, or a second bug. What it does require is timing: the vulnerable code path exists only while a core upgrade is in progress, when WordPress stages the full package and copies files into place. An attacker must be able to reach the staging path over HTTP and request it in the fraction of time during which the check-then-use race can be won. That makes the vulnerable window narrow per upgrade event — but it is not hypothetical, because core upgrades happen on every site on an upgrade cadence, and sites with automatic background updates upgrade frequently without any human present. The official advisory notes the bug is not automatable in the CISA sense, consistent with per-attempt luck rather than a fire-and-forget exploit, yet active exploitation has been confirmed regardless.

There are no published preconditions around access controls that meaningfully restrict this: the staging paths are explicitly reachable by unauthenticated visitors, which is why the CNA description frames the flaw as making unauthenticated code execution possible during the window. Sites on hosting that aggressively caches or blocks requests to upgrade-adjacent paths may reduce exposure incidentally, but that is not a documented, vendor-blessed mitigation — treat patching as the only reliable defense.

Actions and fixes

Update WordPress core immediately. 7.1.4 (released October 28, 2026) fixes the issue in the 7.1 branch, and equivalent backported point releases exist for older branches (for example 7.0.8 and 6.9.11), with remaining eligible branches back through 4.7 receiving backports as they ship. Because only the newest release is actively supported, the practical target is moving to the latest branch plus its security point release. Don't just glance at the Dashboard update nag — confirm the installed version actually reflects the fix, especially on fleets where auto-updates have been disabled.

Given CISA's forensic-triage flag and the November 6 federal due date, organizations with relevant exposure should go beyond patching. The window nature of this bug means the exploit opportunity recurs on every upgrade cycle while unpatched, and KEV triage expectations exist precisely because exploitation during past windows must be ruled out: check access logs for requests to upgrade-adjacent and staging paths coinciding with core-update timestamps, verify core file integrity, and hunt for dropped files or unexpected admin users. If you cannot patch quickly, a defensible interim step is minimizing automatic upgrades temporarily (reducing window frequency), but that trades one risk for patch-lag risk and should be short-lived.

CISA's required action ties this vulnerability into BOD 26-04 risk-based patching guidance; internet-facing WordPress instances should be prioritized. Hosting providers running bulk WordPress estates should treat batch verification of versions plus a log sweep across the affected period as a single coordinated exercise rather than per-site archaeology.

Uncertainty and what could change

Several details remain unpublished and could change the picture. No public proof-of-concept is documented in the sources reviewed, and the number of affected deployments is unknowable from the CVE record alone — the practical exposure depends on how many sites still sit below the patched versions. The exact mechanics of the race (the Wordfence technical page was not retrievable during this review) are summarized here only from the CNA text and CISA's catalog entry; specifics such as whether particular hosting stack behaviors widen the window are not established by the primary sources I could verify.

Watch for three foreseeable updates: further KEV-adjacent threat-intelligence naming the actors exploiting this, discovery of a more reliable exploitation method that raises EPSS and removes the timing dependency from any practical attacker tooling, and any change to CISA's ransomware-use assessment, currently Unknown. The WordPress.org HelpHub page for 7.1.4 may also gain further backport entries as branch releases finalize. None of these unknowns change the action required today: the fix is available, exploitation is confirmed, and the remediation deadline is imminent.

Sources and evidence date

Primary evidence for this analysis: the official CVE record for CVE-2026-119977 (CNA Wordfence, published October 31, 2026, updated November 3, 2026), the WordPress 7.1.4 release announcement on WordPress.org (published October 28, 2026, updated October 29, 2026), and the CISA Known Exploited Vulnerabilities catalog entry (added November 3, 2026) including CISA ADP SSVC and KEV enrichment in the CVE record. The WordPress 7.1.4 documentation page confirmed affected branches and backport point releases. All evidence was gathered November 4, 2026; the Wordfence threat-intel advisory was referenced in the CVE record but its page could not be extracted during this review, so technical mechanics rely on the CNA description and CISA catalog wording.

Timeline, in order: disclosure and fix shipped October 28, 2026 (WordPress 7.1.4); CVE record published October 31; EPSS observed 0.006 on November 3; KEV addition and SSVC active-exploitation confirmation November 3; federal remediation due November 6.

Primary-source links

https://wordpress.org/news/2026/10/wordpress-7-1-4/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977

https://www.cve.org/CVERecord?id=CVE-2026-119977

AI-assisted research and drafting, with a separate model editorial review. CoeLab ratings are editorial judgments, not a substitute for checking your own versions and vendor advisories. Methodology: https://thecoelab.com/blog/security/methodology