CVE-2026-119977: Why Updating WordPress Became a Vulnerability Itself

A paradoxical situation that doesn't happen often in cybersecurity: to close a critical vulnerability, you must update WordPress. But the very process of that update, for a short window of time, opens the site to attack — even after the fix has been released. This is CVE-2026-119977 — a vulnerability in the WordPress core update process that CISA has already added to its Known Exploited Vulnerabilities (KEV) catalog. For Ukrainian site owners, where WordPress is one of the most popular CMSes, this means one thing: you must update, but you must do it right.

What CVE-2026-119977 is

CVE-2026-119977 is a TOCTOU (time-of-check to time-of-use) vulnerability — a "race" between check and use — in the WordPress core update mechanism. It's assigned CVSS 8.1, "High." The vulnerability was found by researcher Umut Bayram of Picus Security, and the CVE identifier was provided by security vendor Wordfence. WordPress officially thanked Bayram for discovering the weakness in the update process.

The essence of the problem is simple but elegant. During a core update, WordPress downloads the new version, unpacks it into a temporary folder, verifies files, copies them over the live installation, and only then removes the temporary folder. The problem is in the gap between unpacking and copying. The temporary copy contains, among other things, the WordPress installer (wp-admin/setup-config.php), which is reachable via the web server and runs without a configured config file. The temporary folder's name is predictable — it's derived from the update package name.

How the attack works: the race between unpacking and copying

The attack requires no account. The attacker operates fully anonymously — they just need to find the right moment and a predictable path.

The scenario: when a site updates with the "complete" package, the new version unpacks into a folder like wp-content/upgrade/wordpress-7.1.4/. Since this folder sits in the public part of the site and PHP files in it run on request, the attacker can reach the installer directly. The situation is worsened by another detail: routine cleanup before unpacking removed the index.php file (which normally blocks directory listing) from wp-content/upgrade/ — so on servers with directory listing enabled, the random folder name could simply be visible.

Before the fix, the scenario was even more dangerous. The attacker could write their own wp-config.php into the temporary copy, which during file copying overwrote the live config file. After that, the site began "looking" at an empty attacker-controlled database, WordPress showed the setup screen, and the attacker created the first administrator. On a typical single-installation site, it's then enough to upload a malicious plugin to execute arbitrary PHP code with web-server privileges.

Wordfence recorded that in lab conditions the vulnerability window lasted mere seconds. Patchstack rates the attack complexity as high. A single request is unlikely to succeed — but continuous automated "polling" substantially raises the odds, and that exact pattern was recorded in real attack traffic.

Why the update that fixes the bug is also dangerous

Here lies the most interesting part of the story, which the researcher himself pointed out. The update that installs the fix unpacks files using the old, still-unpatched code already installed on the site.

WordPress 7.1.4 fixes the vulnerability with three changes:

1. Random temporary folder name — a 16-character random suffix is added to the name (class-wp-upgrader.php).
2. Keeping index.php in the update folder — so a server with directory listing enabled doesn't reveal the random folder name.
3. Excluding wp-config.php from copying during core updates (update-core.php).

But the first two changes "live" in the old code that performs the unpacking. During the first update on sites version 5.9 and newer, the folder name is still derived from the downloaded file's name — i.e., it remains predictable one last time. The third change (skipping wp-config.php) takes effect immediately, because update-core.php is already loaded from the new package.

The practical consequence: during the very update meant to close the vulnerability, the attacker can still reach the temporary installer via a predictable path, configure it with their own database, log in, and execute PHP code with web-server privileges before the temporary folder is deleted. This doesn't let them substitute the live wp-config.php (that's already blocked), but it does let them read and write files in the live WordPress installation.

Who's at risk

The vulnerability affects WordPress from 4.7 to 7.1.3. The fix was released on October 28, 2026 in version 7.1.4 and backported to all supported branches down to 4.7 (4.7.39, 4.8.34, 4.9.35, 5.x, 6.x, 7.0.8, etc.).

Important nuances:

• Complete packages always contain installer files and therefore always expose the site during an update. The complete package is used when moving between branches (e.g., from 7.0.7 to 7.1.4) and during reinstallation.
• Partial packages, which WordPress offers for updates within one branch (e.g., from 7.1.3 to 7.1.4), are dangerous only if they contain installer files.
• Versions 4.4–5.8 add random characters to the folder name, making the path harder to predict — unless the site reveals it itself, e.g., in an error message.
• WordPress 4.6 and older no longer receive security updates — no fix exists for them. Per the researcher, this flaw traces back to WordPress 2.7 (2008). Such sites must be migrated to a supported version.

A separate nuance: a site doesn't always get a partial package even when one exists. WordPress automatically falls back to the complete package if the site's core files don't match the official checksums or if it's a reinstall. So even within one branch, the real scenario can be more vulnerable than it first appears.

The decisive factor, as Bayram emphasizes, is not "complete vs. partial" package but whether the updater already installed on the site has received the fix.

How it was attacked: timeline and scale

The speed with which attackers picked up the vulnerability is telling. Per Wordfence, attack attempts began nine minutes after the company deployed a firewall rule for this flaw on the day the fix was released. Earlier, Wordfence reported nearly 63,000 attack attempts against this vulnerability.

A characteristic detail: the two most active attack sources, over about 14.5 hours, periodically probed small groups of sites. That behavior, per Wordfence's assessment, matches attempts to "catch the moment" when a specific site is updating — i.e., attackers are deliberately hunting the update window.

On November 3, 2026, CISA added CVE-2026-119977 to the KEV catalog, confirming active real-world exploitation. US federal civilian agencies were given a remediation deadline of November 6. Technical breakdowns were also published by Picus Security, Beazley Security, Patchstack, Ostorlab, and others.

Why this matters right now

The CVE-2026-119977 story shows a broader trend everyone who administers websites should know. First, WordPress remains one of the most attacked platforms in the world — the moment a core vulnerability appears, both researchers and attackers instantly focus on it. John Strand of Black Hills Information Security compares this attention to the "Eye of Sauron": as soon as one vulnerability appears, a "bunch of people digging in one direction" forms around the technology.

Second, the speed of exploit development is growing. Umut Bayram told TechFinitive that AI tools make such research accessible to a much wider circle — attackers included. "If a beginner researcher can find a twenty-year-old RCE in one day, an attacker can too," he says. This is a direct argument for not postponing response.

Third, the researcher's conclusion about security validation. "Validation can no longer wait for the next scheduled test," Bayram advises. "It must run immediately when something changes: a new CVE is out, an advisory appears, someone changed a firewall rule. That is the signal."

How to protect yourself: step-by-step

1. Update WordPress to 7.1.4 immediately — or install the backport for your branch. This is the first-priority step.
2. Block web access to wp-content/upgrade before updating. This is researcher Umut Bayram's direct recommendation: this is how you close the window that opens during the fix installation. For Apache — a rule in .htaccess; for Nginx — a corresponding location block with denial.
3. Verify the update actually installed — in "Dashboard → Updates." This applies to sites with automatic background updates too: they install the fix through the same mechanism.
4. Audit for signs of compromise. BreachLock CEO Simant Sehgal advises looking for: unexpected files in temporary update folders, unknown admin accounts, modified theme/plugin code, and unusual outbound traffic from the web server.
5. For sites on WordPress 4.6 and older, no fix exists — the only way out is migration to a supported version.
6. Reduce web-server privileges and ensure PHP in the update folder can't run over the web. Least privilege limits the damage even if the attack window fires.

Worth knowing: the official WordPress 7.1.4 announcement offers no workaround. So blocking web access to wp-content/upgrade remains the practical way to reduce risk at update time, and for sites that can't be updated immediately, such blocking substantially lowers the odds of a successful attack.

If you suspect your site may already be compromised, check whether your credentials have leaked using our breach-check tool. And if you want a deeper look at how modern web-application defense works, see our material on cybersecurity learning.

Conclusion

CVE-2026-119977 is a rare case where the update procedure itself becomes an attack vector, and the "fix" doesn't provide full protection while it's being installed. This is an important lesson for everyone who administers sites: an update isn't a single-click button but a process with its own risk window. The right answer is to update quickly but with control: block web access to the service folder, verify installation actually happened, and audit afterward. And Umut Bayram emphasizes a broader conclusion: security validation shouldn't wait for the next scheduled test — it must run immediately when a new CVE or advisory appears.