WordPress: race condition in core upgrades (CVE-2026-119977) reported exploited, fixed in 7.1.4
Published 04/11/2026 02:00
Timeline
4 events over 5 d 1 h
- 30/10/2026ConfirmedVulnCheck KEV+4 d
- 03/11/2026CorroboratedCISA Known Exploited Vulnerabilities+0 min
- 03/11/2026ExploitedCISA Known Exploited Vulnerabilities+1 d 1 h
- 04/11/2026 02:00Published on WatchtowerPro CISO
In short
WordPress core has a race condition during full-package core updates that lets an unauthenticated attacker run code on the server. VulnCheck reports that it is being exploited. Update to 7.1.4 on the 7.1 branch and block web access to PHP files under /wp-content/upgrade/. Shodan estimates about 1.0 million internet-facing WordPress servers worldwide, 174,955 of them in the EU (04/11/2026); how many run an affected version is not yet known. GreyNoise reports a public exploit for CVE-2026-119977; listed by CISA as known exploited (04/11/2026).
How bad is it
High. An attacker on the internet who wins a timing race while a WordPress core update is running can run their own code on the site, without logging in.
Being exploited - on CISA's known-exploited list since 03/11/2026.
Severity score
CVSS 3.1 from NVD, from wordfence.com, read 04/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- WordPress 4.7 through 7.1.3 per the CVE record as copied by INCIBE-CERT.
- The WordPress advisory lists every branch from 4.7 to 7.1, up to the last vulnerable releases (for example 7.1.3, 7.0.7, 6.9.10).
- The attack only works during a full-package core upgrade, and only if the staged files are reachable over HTTP.
Fixed in
- 7.1 branch: 7.1.4 (released 28/10/2026)
What to do now
- Put a deny rule for direct HTTP access to any .php file under /wp-content/upgrade/ in place first, then update.
- Update WordPress to 7.1.4 on the 7.1 branch.
- Know which sites update themselves, because automatic background updates can start the vulnerable upgrade process without anyone watching.
- Check wp-content/upgrade/ for unexpected PHP files, and access logs for requests into that path.
- Interim measures reduce exposure and do not make a server safe; only the update fixes the flaw.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run WordPress, at which version, fixed or not - and what each one needs.
Main sources
Known exploited: WordPress WordPress Core - WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Vendor · Known exploited (VulnCheck KEV): - CVE-2026-119977 Research · CVE-2026-119977 Research
Data: Shodan - WordPress (estimate, 04/11/2026) · GreyNoise - CVE-2026-119977 (estimate, 04/11/2026)