WordPress CVE-2026-119977 is the flaw to deal with today, even though July's wp2shell chain proved the more damaging of the two so far. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026, and federal agencies must remediate by November 6, 2026. Wordfence, which rates the flaw CVSS 8.1, reported it blocked 13,095 attacks against it in a single 24-hour period. wp2shell was worse in its impact, but it is patched and largely cleaned up; this one is live, widely reachable and on a deadline.
Last verified: 2026-11-06
TL;DR
- WordPress CVE-2026-119977 is a race condition in the core upgrade process that can let an unauthenticated attacker run code on the server.
- Affected: WordPress 4.7.0 through 7.1.3. Fixed in WordPress 7.1.4, with backports to every branch still receiving security fixes.
- Verdict: wp2shell was the more severe flaw, but CVE-2026-119977 is the one with active exploitation and a deadline right now.
- Patching is not enough on its own. Check for signs the upgrade window was abused before you trust a patched server.
- Block web access to
/wp-content/upgrade/as a standing control, not a one-off fix.
How does WordPress CVE-2026-119977 compare with wp2shell?
The two flaws differ mainly in how they are triggered and how fast they were weaponised. wp2shell was a chain of two bugs that anyone could hit at any time; CVE-2026-119977 only opens during a core upgrade, but automatic background updates make that happen constantly.
| CVE-2026-119977 | wp2shell | |
|---|---|---|
| Type | Time-of-check Time-of-use race in core upgrades | REST API batch-route confusion (CVE-2026-63030) plus SQL injection (CVE-2026-60137) |
| Result | Remote code execution during the upgrade window | Remote code execution |
| Trigger | Unauthenticated, only while an upgrade runs | Unauthenticated, any time on an unpatched site |
| Fixed in | 7.1.4 and branch backports | July 2026 security release |
| Public exploit | None indexed as of early November | Appeared one day after the patches |
| Attack complexity | High (AC:H in the Wordfence vector) | Low in practice once exploits circulated |
On raw danger, wp2shell wins. Public exploits appeared a day after the July patches, and unpatched servers were breached within days. The September follow-up, in which an operator reportedly used wp2shell to take data from small-business and government databases, shows what happens when a site is left behind.
On urgency, CVE-2026-119977 wins today. It is confirmed as exploited, it has a hard federal deadline, and the affected range reaches back to WordPress 4.7.0, so it covers many old installs.
What is WordPress CVE-2026-119977?
It is a Time-of-check Time-of-use race condition in WordPress core's upgrade process. During a full-package core upgrade, WordPress unpacks files into staging paths under wp-content/upgrade that are predictable and reachable over the web. An unauthenticated attacker who requests the right path at the right moment can get code executed on the server.
The WordPress security team described it as a weakness in the upgrade process that can lead to remote code execution during the upgrade window, in its 7.1.4 release announcement. The researcher credited is Umut Bayram of Picus Security.
Severity ratings disagree, and that is worth knowing. WordPress' own GitHub advisory (GHSA-4w3m-c66w-69mg) rates it Low. Wordfence, acting as the CNA, scores it 8.1 High using the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The NVD entry was still undergoing analysis with no final score at the time of writing. The gap comes down to the timing requirement: it lowers the odds of any single attempt, but not the impact of a successful one.
What is the timeline for the CISA deadline?
Our analysis of the primary dates puts the patch-to-confirmed-exploitation interval at six days (October 28 to November 3), and the patch-to-federal-deadline interval at nine days. That is short enough to make "we will patch on Friday" a risky plan.
| Date (2026) | Event |
|---|---|
| October 28 | WordPress 7.1.4 and branch backports released |
| October 31 | CVE published in the NVD |
| November 1 to 2 | Wordfence reports blocked attacks and probing for staged setup-config.php paths |
| November 3 | CISA adds the CVE to the KEV catalog |
| November 6 | Deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04 |
Wordfence also logged more than 18,500 requests polling for those staged paths in the first 21 hours, according to its advisory. No public proof of concept or published indicators of compromise had been indexed as of early November.
Who is affected by WordPress CVE-2026-119977?
Any site running WordPress core from 4.7.0 through 7.1.3 is affected. WordPress remains the most-used CMS, running about 43% of all websites according to W3Techs, so the exposed population is large even if only a fraction are mid-upgrade at any moment.
Fixed releases are 7.1.4 and the backports 7.0.8, 6.9.11 and 6.8.12, plus lower branches back to 4.7. If your host controls core updates, confirm the version rather than assuming it moved.
What should defenders do today?
Work through these in order. None of it requires exploit knowledge, and none of it should include testing the flaw against your own production site.
- Confirm the version. Check Dashboard, then Updates, or run
wp core versionandwp core updatewith wp-cli. You want 7.1.4 or your branch's backport. - Triage before you trust. CISA flags this entry for forensic review, and it is sensible for everyone. Look for unexpected PHP files under
wp-content/upgrade, new administrator accounts, plugins you did not install, and access-log entries requesting stagedsetup-config.phppaths. - Block web access to
/wp-content/upgrade/at the web server or WAF. Nothing legitimate needs to fetch from it over HTTP. - Keep the block permanent. The race window lasts seconds per upgrade, but background updates repeat, so exposure recurs on every update if the control is missing.
- Rotate credentials if you find anything suspicious: WordPress admin passwords, database credentials and the salts in
wp-config.php.
The same lesson applies to Ivanti's three patched zero-days and their CISA deadline: a patch date starts the exploitation clock rather than ending the risk. And as the Synology C3RB3R case showed, the machines nobody remembers owning are usually where intrusions begin.
Why does this matter for small sites in India?
Most Indian small-business, school and agency microsite WordPress installs are self-managed on shared hosting, often with no WAF, which is the population wp2shell hit hardest in September. These owners are least likely to read a CISA alert and most likely to have auto-updates switched off or stuck.
I found no dedicated CERT-In advisory for this CVE at the time of verification. CERT-In does publish notices on actively exploited flaws at cert-in.org.in, so check there for any later guidance. In the meantime:
- Ask your hosting provider for the exact WordPress version running on each site, in writing.
- If you use a managed plan, ask whether
wp-content/upgradeis blocked from web access. - If you cannot update, take the site offline or behind a maintenance page rather than leaving it exposed.
Choosing the platform matters as well. If you are weighing a hosted builder against self-managed WordPress, our comparison of AI website builders covers how much patching each one leaves to you. Teams extending WordPress with AI tooling should also read our piece on Claude and Elementor, since extra plugins widen the surface you must monitor. On the disclosure side, OpenAI's raised bug bounty payouts are a useful reference for why researchers like the one behind this report keep finding flaws in core code.
FAQ
Q: Is WordPress CVE-2026-119977 being exploited?
A: Yes. CISA added it to the KEV catalog on the basis of evidence of active exploitation, and Wordfence reported blocking attacks against it. No public proof of concept had been indexed at the time of writing.
Q: Which WordPress versions fix CVE-2026-119977?
A: WordPress 7.1.4 fixes it, with backports in 7.0.8, 6.9.11, 6.8.12 and lower branches that still receive security fixes. Affected versions run from 4.7.0 through 7.1.3.
Q: Does the November 6 deadline apply to my business?
A: Formally, it applies only to US Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. Private organisations are not bound by it, but the KEV listing is a reliable signal that attackers are using the flaw.
Q: Is updating to 7.1.4 enough?
A: Not by itself. If your site ran an affected version while exposed, check for unexpected PHP files under wp-content/upgrade, new admin users and unknown plugins before you consider it clean.
Q: Why do the severity scores differ?
A: WordPress' own advisory rates it Low, while Wordfence rates it High and NVD has not yet scored it. The disagreement reflects the timing requirement against the full impact of code execution.
Top comments (0)