SockAnalyst
← All playbooks
HighExploited vuln · 2026-11-03

WordPress Core CVE-2026-119977: upgrade-window RCE now on CISA KEV (due Nov 6)

What happened

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026 after confirming active exploitation. The flaw is a time-of-check time-of-use (TOCTOU) race in the WordPress Core upgrade process: predictable, web-accessible staging paths during full-package upgrades can let an unauthenticated attacker execute code on the server during the upgrade window. WordPress shipped the fix in 7.1.4 on October 28, 2026 (reported by Picus Security researcher Umut Bayram). Wordfence said it blocked more than 13,000 attack attempts targeting the bug in a 24-hour window.

Who's affected

Any site still running WordPress Core below 7.1.4 (or the matching security backport for older branches). Federal Civilian Executive Branch agencies must remediate by the CISA KEV due date of November 6, 2026.

✅ Fix / patch

  • Update WordPress Core to 7.1.4 or the patched security release for your branch immediately (Dashboard → Updates, or your usual deploy path).
  • Until patched, deny web access to /wp-content/upgrade/ at the web server, WAF, or CDN so staged upgrade files cannot be reached over HTTP.
  • After updating, review web logs around any recent Core upgrade for unexpected requests under /wp-content/upgrade/ and check for unfamiliar plugins, themes, or admin users.

🔎 Quick hunt check

Look for HTTP requests to predictable paths under /wp-content/upgrade/ during or right after a Core update, especially from unfamiliar IPs, and for new PHP files or webshells dropped under wp-content shortly after an upgrade.

MITRE ATT&CK: T1190, T1059, T1505.003

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

No public IOCs published for CVE-2026-119977 exploitation; Wordfence reported blocking attack volume without releasing indicators.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=* (uri_path="*/wp-content/upgrade/*" OR url="*/wp-content/upgrade/*" OR http_uri="*/wp-content/upgrade/*")
| stats count dc(src) as sources values(src) as src min(_time) as first max(_time) as last by uri_path, status, http_user_agent
| sort - count
union isfuzzy=true
 (CommonSecurityLog | where RequestURL has "/wp-content/upgrade/"),
 (AzureDiagnostics | where requestUri_s has "/wp-content/upgrade/"),
 (DeviceNetworkEvents | where RemoteUrl has "/wp-content/upgrade/")
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP=coalesce(SourceIP, clientIP_s, InitiatingProcessRemoteIP), RequestURL=coalesce(RequestURL, requestUri_s, RemoteUrl), DeviceName

⏱ CISA deadline

CVE-2026-119977CVSS 8.1 High (v3.1, CNA)
--
Federal due 2026-11-06

Sources

Related playbooks