MDR
Solutions
Partners
About
Resources
High
Wordpress
November 4, 2026
A high-severity vulnerability in WordPress Core, tracked as CVE-2026-119977 (CVSS 8.1), is reportedly being actively exploited and has been added to CISA's Known Exploited Vulnerabilities catalogue. The flaw involves a time-of-check to time-of-use (TOCTOU) race condition during WordPress Core upgrades. Unauthenticated attackers may exploit predictable, web-accessible staging paths to execute arbitrary code on affected servers during the upgrade process.
WordPress Core versions 4.7 through 7.1.3.
Web-accessible temporary files and staging paths during full-package WordPress Core upgrades.
Apply appropriate WordPress security updates and assess potentially affected websites for compromise.
The vulnerability affects WordPress Core versions 4.7 through 7.1.3, according to the supplied advisory.
Websites undergoing full-package WordPress Core upgrades are exposed during the vulnerable upgrade window. Exploitation does not require an authenticated WordPress account, increasing the potential risk to publicly accessible websites.
Organisations managing multiple WordPress installations should prioritise identifying affected versions and reviewing their update processes.
Successful exploitation could allow an unauthenticated attacker to execute arbitrary code on an affected WordPress server during a core upgrade.
Potential consequences include website compromise, malicious file deployment, unauthorised access to application data, website defacement and disruption of business-critical web services.
Organisations relying on WordPress for customer-facing websites, marketing platforms or digital services may face operational and reputational consequences following exploitation.
CVE-2026-119977 is attributed to a time-of-check to time-of-use race condition in the WordPress Core upgrade process.
During full-package upgrades, predictable staging paths may become accessible through the web server. An unauthenticated attacker could exploit the timing between file validation and subsequent use to execute malicious code.
The vulnerability is associated with the upgrade mechanism rather than a WordPress plugin or theme.
Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.
Discuss Your Security ExposureSecure Your Web Applications Against Emerging ThreatsAssess your risk
Identify affected systems
Plan remediation
Practical, vendor-aligned guidance
Get expert support
From our 24/7 security team
Get the latest threat intelligence and security advisories from Smarttech247.
View All Threat UpdatesDownload the complete analysis, including detailed technical findings and references.
The Hacker News — Reported active exploitation
.jpg)