Executive Summary

On November 3rd, 2026, CISA added a high-severity WordPress Core vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. Tracked as CVE-2026-119977, the flaw lets an unauthenticated, remote attacker execute code on the server. The attacker does this by reaching installer files that WordPress briefly stages in a predictable, web-accessible directory during a full Core upgrade. WordPress Core 4.7 through 7.1.3 is affected, and WordPress released fixes on October 28th.

WordPress is a widely deployed content management system that runs public websites for businesses and government organizations. The exposure window lasts only seconds per upgrade, but attackers are automating requests to catch it. Earlier this year, attackers used "wp2shell", a chain of WordPress Core flaws, to plant webshells and steal data from unpatched sites.

Exploitation attempts began within hours of the fix's release, and CISA has not disclosed how many sites have been compromised. Given unauthenticated code execution, confirmed exploitation, and recent attacks against WordPress Core, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.

Affected Systems or Products

Product

Affected Versions

Fixed Versions

WordPress Core 7.1

7.1.0 through 7.1.3

7.1.4

WordPress Core 4.7 through 7.0 branches

4.7.0 through 7.0.7, each branch before its fixed release listed

4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8

Mitigations / Workarounds

WordPress recommends that site owners update immediately. It backported the fix to all branches eligible for security fixes (currently through 4.7) and states that only the most recent version is actively supported, so moving to 7.1.4 is preferable to relying on branch backports. WordPress 4.6 and earlier receive no security updates and must be upgraded to a supported release. The WordPress 7.1.4 announcement offers no workaround. Confirm under Dashboard > Updates that the security release installed, even on sites that receive automatic background updates.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

  • Block direct web requests to wp-content/upgrade/ at the web server or reverse proxy, as Patchstack advises, and confirm that the directory cannot be listed.

  • Do not rely on a WordPress security plugin alone. Patchstack states that plugin firewalls cannot stop this attack because the staged copy loads WordPress from its own files. Wordfence states that its firewall covers the attack only when "Extended Protection" is enabled, which runs the firewall before any PHP file executes.

  • Inventory forgotten development, staging, and legacy WordPress installations, which may not receive automatic updates.

These measures reduce exposure while updates are applied but do not replace installing the fixed release.

Patches

WordPress released 7.1.4 on October 28th, 2026, and backported the fix to affected branches through 4.7. Updates are available through the WordPress dashboard, and details are in the WordPress 7.1.4 announcement.

Indicators of Compromise

On November 3rd, 2026, CISA added CVE-2026-119977 to its KEV catalog, confirming active exploitation in the wild. CISA has not attributed the activity or disclosed how many sites were compromised.

Review web server and WAF access logs for:

  • Requests to PHP files beneath wp-content/upgrade/, especially staged copies of setup-config.php.

  • Repeated requests across many staging directory names, which indicate automated polling.

  • Any such request close to the timestamp of a Core upgrade. These deserve the closest scrutiny.

Then review the site for unfamiliar administrator accounts, unexpected plugins, PHP files you did not place, changes to WordPress configuration, unusual child processes of the web server, and unexpected outbound connections. Adjust log paths for your environment:

grep -E "wp-content/upgrade/.*\.php" /var/log/apache2/access.log* /var/log/nginx/access.log*
grep "setup-config.php" /var/log/apache2/access.log* /var/log/nginx/access.log*

Completing the upgrade removes the vulnerable behavior. It does not show that a site escaped compromise during an earlier upgrade window. If compromise is suspected, preserve web, application, and system logs before remediation. Then rotate credentials and secrets accessible to the WordPress process, including database credentials.

No atomic indicators such as attacker IP addresses or file hashes have been published at the time of writing.

Technical Details

CVE-2026-119977 is a time-of-check time-of-use (TOCTOU) race condition in the WordPress Core update process, reported by Umut Bayram of Picus Security. When WordPress applies a Core update from a complete package, affected versions unpack the new files into a predictable directory beneath wp-content/upgrade/ before replacing the live installation. The directory is named after the package. A cleanup routine also deletes the index.php file that normally prevents directory listing. That temporary copy includes the WordPress installer, wp-admin/setup-config.php, which runs without the site's configuration file. On many servers the staging tree is reachable from the web and PHP executes there.

Exploitation has several preconditions, which is why the flaw is rated High rather than Critical. The attacker needs four things: a full-package update that contains the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to finish before cleanup. Patchstack rates the attack complexity as high. Wordfence observed the window lasting only seconds in lab environments. A single request is unlikely to succeed, but continuous automated polling improves the odds, and the observed attack traffic follows that pattern.

WordPress 7.1.4 appends 16 random characters to the staging directory name, recreates and keeps index.php, and prevents wp-config.php from being copied out of the working directory. The patch references point to the fixed code in

wp-admin/includes/class-wp-upgrader.php

and

wp-admin/includes/update-core.php

in the 7.1.4 release. No public proof-of-concept (PoC) exploit is known at the time of writing. The only public repository that references the flaw is a version scanner, which does not exploit it.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources