WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

Joao Cruz@joaocruz32

2/ What it is: CVE-2026-119977. An attacker with no account can run code on your server by exploiting a timing flaw during a full WordPress core upgrade. CISA added it to its Known Exploited Vulnerabilities list on Nov 3.

modularciso@modularciso

WordPress Core CVE-2026-119977 CVE-2026-119977 lets an unauthenticated attacker who wins a race run code during a full-package core update. CISA added it to KEV on Nov 3. Affected: 4.7 to 7.1.3. Fixed in 7.1.4 and backports. Wordfence logged 18,500+ requests in 21 hours. Have you checked every site you own? #infosec thehackernews.com/2026/11/cisa-c…

Marwan Moftah@MarwanMoftah

WordPress CVE-2026-119977 joined CISA's exploited list Nov 3. What: core updates stage files at a guessable web path Who: 4.7 to 7.1.3 Fix: 7.1.4 or your branch's backport Can't patch tonight: block web access to /wp-content/upgrade/ Exploited: yes Has your host patched you?

Nathan Harrell | Wireless Networks & Crypto@wirelesslyhere

WordPress admins: CISA added CVE-2026-119977 to its exploited list Nov 3. A race in core updates (4.7 to 7.1.3) lets an unauthenticated attacker run code mid-upgrade. Confirm 7.1.4 or your branch's backport in Dashboard > Updates. Don't assume auto-update did it. #infosec

siri@fu4k1@sirifu4k1

WordPress 7.1.4 Upgrade-Window RCE (Repro Highlights) On Oct 28, 2026, WordPress released 7.1.4, fixing a remote code execution issue during the upgrade window (reported by Umut Bayram, CVE-2026-119977). The issue isn’t in the installer itself, but in the upgrade process: a full core upgrade extracts a complete WordPress copy into wp-content/upgrade/wordpress-/. In 7.1.3, this directory is cleared before extraction (including index.php), and the directory name is derived solely from the package filename. During those few seconds, anyone who can reach the site can access the staged copy’s wp-admin/setup-config.php. Repro highlights: •Complete installation against the attacker’s own MySQL → log into the temporary admin → upload a plugin containing PHP → achieve code execution in the target site’s directory •Local testing showed a natural window of ~2.05s (29 hits out of 221 polls); full chain succeeded with command echo of uid=1000 •The uploaded PHP persists even after the upgrade finishes and the temporary directory is deleted •Shorter path: a single request writes wp-config.php; on a later upgrade to an unpatched version or reinstall, this config is copied to the site root, switching the site to the attacker’s database so the attacker can log into the live admin Exploitation requirements: full-package upgrade + wp-content/upgrade web-accessible and able to execute PHP + target can reach the attacker’s MySQL + requests completed inside the window. Analysts note real-world exploitation is not straightforward. Fix: 7.1.4 adds a 16-character random suffix to the directory name, preserves index.php, and skips copying wp-config.php. Key point: Patching does not make the window disappear immediately. The upgrade from 7.1.3 to 7.1.4 is still performed by the old code and still uses the predictable directory. The fix protects subsequent upgrades. If you can’t upgrade yet: block access and PHP execution for wp-content/upgrade/ at the web server layer. For authorized security research and defense only. Update to 7.1.4 (or the corresponding backport) now. #WordPress #Security #RCE

Maurizio Schmidt@MauriSecOps

Das Update selbst ist die Lücke. CVE-2026-119977: Remote Code Execution ohne Login in WordPress Core. Genau in dem Moment, in dem ihr updatet. CISA hat sie am 03.11. in KEV aufgenommen. Aktiv ausgenutzt. Ein Thread von Maurizio Schmidt 🧵

よもぎのセキュリティ日報@salonyoza

【11/05 セキュリティ朝報】 ①Zyxel GS1900スイッチの0day(CVE-2026-107441)修正。旧CVEのパッチを迂回され約1000台が侵害 ②WordPressのCVE-2026-119977がKEV入り。7.1.4へ更新を zyxel.com/global/en/supp… wordpress.org/news/2026/10/w… #インフラ朝報