CVE-2026-119977
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
CISA says: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Show me how to fix itTimeline
- Published by NVD
- Added to CISA known exploited list
- First covered by RedTeamDaily
- Last updated by NVD
Coverage
CISA adds actively exploited WordPress Core race condition flaw to its KEV catalogue
CISA has added CVE-2026-119977, a time-of-check to time-of-use race condition in WordPress Core, to its Known Exploited Vulnerabilities catalogue on 3 November 2026. The Canadian Centre for Cyber Security's advisory AV26-1117 says WordPress Core versions before 7.1.4 are affected, so administrators should update to 7.1.4. Separately, HTTP2Shell (CVE-2026-111497), a critical remote code execution flaw in the Brotli compression library used by Node.js, Bun, Envoy and Python, was found by OpenAI's agents and is still awaiting fixes.
Sources: NVD and CISA known exploited vulnerabilities catalogue.