Overview
- Researcher Umut Bayram disclosed CVE-2026-119977, a time-of-check/time-of-use flaw that can let unauthenticated attackers run code by reaching temporary installer files that WordPress unpacks under wp-content/upgrade.
- WordPress released fixes in version 7.1.4 on October 28 and backported them to supported branches down to 4.7, but the site’s existing updater still unpacks the update with old code which can create a last exploitable window.
- The U.S. Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalog on November 3 and set a November 6 remediation deadline for federal civilian agencies with required forensic checks.
- Security vendors reported rapid, automated probing and blocking of attacks after the fix went public, with Wordfence logging more than 240,000 blocked exploitation attempts by November 6.
- Administrators are advised to deny web access to /wp-content/upgrade via server configuration or perform manual updates outside the web root, confirm updates finished, and review logs and admin accounts for signs of compromise; unsupported pre-4.7 sites should be migrated.