CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3. The federal deadline for civilian agencies to patch is today, November 6. Wordfence blocked over 13,000 exploit attempts in a single 24-hour window. If you run WordPress and have not yet patched, this post is for you.
What the flaw is
CVE-2026-119977 is a time-of-check to time-of-use (TOCTOU) race condition in WordPress Core's upgrader. When WordPress performs a full package core update, it unpacks files into a staging directory at wp-content/upgrade/ before moving them into place. That staging directory includes setup-config.php and is reachable over HTTP on a large number of server configurations.
The staging window lasts only a few seconds, so attackers poll the path repeatedly. An unauthenticated attacker who hits the staging directory at the right moment can push the installer toward PHP code execution on the server. CVSS base score is 8.1. It affects WordPress 4.7.0 through 7.1.3.
What to do right now
Update to WordPress 7.1.4, released October 28. That release also fixes 22 other security vulnerabilities. Backports reach back to 4.7.39 for older branch users. Run wp core version to check, and wp core update --minor to update within your current branch.
While patching, block HTTP access to wp-content/upgrade/ at the web server layer. This does not replace the patch, but it closes the attack window while you work through your upgrade cycle. After patching, run wp core verify-checksums and review your web logs for requests to staged PHP files, unexpected admin users, and unknown plugins.
One note on Wordfence: the free-tier firewall rule for this vulnerability is not scheduled for release until November 27. Free-tier users cannot rely on the WAF rule as a compensating control. The patch is the only reliable mitigation.
Why race-condition bugs in update paths are hard to defend against
Race conditions in auto-update machinery are a recurring category. The update process is trusted code running with elevated privileges, and defenders tend not to monitor the filesystem paths it touches. Attackers who understand the update flow can target the exact window between file extraction and final installation.
The lesson applies beyond WordPress. Any software that stages update files in a web-accessible directory, even briefly, should have that directory blocked from external access by default. That is a reasonable security baseline that most hosting setups do not enforce automatically.
Context on the federal deadline
CISA's Binding Operational Directive BOD 26-04 requires Federal Civilian Executive Branch agencies to remediate KEV-listed vulnerabilities on the schedule CISA sets. The November 6 deadline for CVE-2026-119977 is aggressive, reflecting the severity of active exploitation. For non-federal organizations, the KEV catalog is a reasonable priority signal: if federal agencies are required to patch immediately, your organization should treat it as urgent too.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help prioritizing your patch cycle or assessing WordPress exposure in your environment.