CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch and protect upgrades.
The Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are exploiting a WordPress core vulnerability that can let them take over websites during an update. Tracked as CVE-2026-119977, the vulnerability affects the updater’s handling of temporary installation files and can allow remote code execution without an account on the targeted site.
The vulnerability was found by Umut Bayram, a security researcher at Picus Security. It carries a CVSS score of 8.1 and was added to CISA’s Known Exploited Vulnerabilities catalog on November 3.
Although the disclosure is recent, Bayram traced the underlying behaviour to WordPress 2.7, released in 2008. Public advisories list affected versions from 4.7 through 7.1.3, while his research describes older releases as affected too. Whether an installation can be exploited depends on its update package, server configuration and the attacker’s ability to locate the temporary files.
How an Update Can Expose a Website
During a core update, WordPress extracts downloaded files into a temporary directory under wp-content/upgrade/ before copying them into the live installation. If the package contains the WordPress installer and the server allows web access and PHP execution in that directory, an attacker can reach a temporary copy of WordPress while the update is running.
The temporary installer checks nearby locations for an existing configuration file but does not find the live site’s wp-config.php. It therefore treats the extracted copy as an installation that has not yet been configured.
An attacker who reaches it in time can supply connection details for a database they control. The installer then creates a new wp-config.php inside the temporary directory.
On vulnerable releases, the updater can copy that attacker-created file over the live site’s configuration. This redirects WordPress to the attacker’s database, where they can create an administrator account. On a typical single-site installation that permits administrators to install plugins, this provides a route to executing PHP code on the server.
Bayram describes the sequence in his published technical analysis. The attack depends on winning a time-of-check time-of-use race condition, meaning the attacker must act between stages of the update before WordPress removes the temporary installation.
Not every update exposes the necessary files. The attacker also needs to determine the staging directory’s location. Some older releases added randomness to that path, making exploitation dependent on another way to learn its name.
WordPress Has Released Fixes
WordPress released version 7.1.4 on October 28 to address the vulnerability. The fix randomises temporary directory names, preserves a file that prevents directory listings and stops a staged wp-config.php from being copied over the live configuration.
Security fixes were also backported to older branches down to 4.7. WordPress notes that only its latest version is actively supported. Releases from 2.7 through 4.6 did not receive this fix and should be upgraded.
For applicable federal systems, CISA set November 6 as the remediation deadline and listed forensic triage as required under Binding Operational Directive 26-04. Its exploitation warning does not identify the attackers or disclose how many websites have been compromised.
The First Patched Update Still Needs Protection
Installing the fix requires an additional precaution because the extraction stage runs through the updater already installed on the website.
When an unpatched site updates to a fixed release, the new code prevents the temporary configuration file from replacing the live one. However, the old extraction code can still leave a temporary installer at a predictable, web-accessible location.
An attacker could configure that temporary installation and execute PHP code before WordPress cleans it up. Code running there would have the web server’s permissions, including whatever access those permissions provide to the live site’s files.
Bayram recommends denying web access to wp-content/upgrade/ before starting the update and confirming that requests to the directory return a 403 response. The restriction should be applied through the server configuration or the WordPress root .htaccess file, not inside the upgrade directory, where the updater could delete it.
Alternatively, administrators can download and extract the patched release outside the public web directory, then manually replace the core files while preserving wp-config.php and wp-content. A standard wp core update command is not a substitute for that method because it uses the same core updater.
Research Took About Four Hours With AI Assistance
Bayram said he found the vulnerability using GPT-5.6 Sol as a research partner, taking about four hours from examining the updater to producing a working exploit chain.
In comments shared with Hackread.com, he warned that faster vulnerability research also gives attackers more opportunities to find weaknesses in widely deployed software.
“If an early-career researcher can find a two-decade-old RCE in an afternoon, so can an attacker,” Bayram said.
He also noted that production updates take time, leaving organisations exposed even after a patch becomes available.
“Until then, there’s a window where you’re exposed, and that’s exactly where attackers are working,” he said.
Bayram urged organisations to validate their defences when systems change, rather than waiting for scheduled testing.
“That’s the signal, and that’s when you need to find out whether you’re exploitable and whether your controls would actually stop it.”
