CVE-2026-119977: WordPress upgrade flaw is being exploited, update to 7.1.4

What the flaw is

CVE-2026-119977 is a race conditiona bug that depends on timing: two actions run at nearly the same moment and the attacker wins the "race" by acting in the gap between a check and its use in the code WordPress uses to upgrade itself. The CVE record, written by Wordfence as the CNACVE Numbering Authority, an organization allowed to assign CVE IDs and write the official description, says the problem comes from "predictable, web-accessible staging paths" used during full-package core upgrades. In plain terms, while WordPress unpacks a new version, the temporary files sit at an address an outsider can guess and reach from the web.

That gives an unauthenticated attacker a short window to execute code on the server. The weakness type is CWE-367, time-of-check to time-of-use.

How serious it is

Wordfence gave the flaw a CVSS 3.1 base score of 8.1 (High). The vector is AV:N/AC:H/PR:N/UI:N: it can be attacked over the network, needs no privileges and no user action, but the attack complexity is high because the attacker has to hit the upgrade window.

On November 3, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogCISA's public list of flaws with evidence of use in real attacks; US federal agencies must patch them by a deadline, based on "evidence of active exploitation". US federal civilian agencies had until November 6 to fix it.

Proof of concept or real attacks?

CISA's listing means it has evidence of real attacks. A public proof of conceptdemonstration code showing that a flaw can be exploited, often published by researchers; on its own it does not mean anyone has been attacked would be a separate fact, and we found no published exploit code. CISA has not named the attackers or said how many sites were compromised. CISA's own assessment marks the flaw as not automatable, which fits an attack that depends on timing.

What to do now

1. Check your version. In the admin area, go to Dashboard > Updates. If it shows anything from 4.7.0 to 7.1.3, you are in the affected range.
2. Update to 7.1.4. WordPress says sites with automatic background updates will start the update on their own, so confirm that it finished.
3. On an older branch, WordPress says fixes are being backported to every branch down to 4.7 and will ship as they become ready. Only the latest version is actively supported, so 7.1.4 is the safer target.
4. If your site ran a core upgrade before 7.1.4, look for signs of compromise: unknown PHP files in the WordPress directories, new administrator accounts, or changes you did not make.

WordPress 7.1.4 fixed 22 security issues in total, most of them cross-site scripting. Its release notes list this one as "a race condition during core updates that could lead to remote code execution", credited to researcher Umut Bayram.

Phones got their own batch of fixes the same week: our analysis of the Android November 2026 security bulletin explains CVE-2026-58868, its most severe flaw.