WordPress vulnerability CVE-2026-119977 is a race condition in WordPress Core's update process that can lead to remote code execution. It is fixed in WordPress 7.1.4, released October 28, 2026, and in fixed versions for older branches. On November 3, 2026, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog. If your self-hosted WordPress site runs a version older than 7.1.4, update now, confirm your version and check your site for signs of compromise.
What happened with WordPress vulnerability CVE-2026-119977
On October 28, 2026, WordPress.org released WordPress 7.1.4, a security release. Its fixes include "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window", reported by researcher Umut Bayram. WordPress.org's 7.1.4 documentation describes the same fix as "A race condition during core updates that could lead to remote code execution". The researcher's write-up confirms the flaw is tracked as CVE-2026-119977.
On November 3, 2026, CISA added CVE-2026-119977 to the KEV catalog, naming it a "WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability" in its alert. The Canadian Centre for Cyber Security confirmed the listing the same day in advisory AV26-1117. CISA adds vulnerabilities to the KEV catalog based on evidence of active exploitation.
WordPress.org's advice is direct: "Because this is a security release, it is recommended that you update your sites immediately."
Who is affected: is my WordPress site vulnerable to CVE-2026-119977?
The flaw is in WordPress Core, the base software every WordPress site runs. The files changed in 7.1.4 include WordPress's core updater, so this is not a plugin or theme problem.
The Canadian Centre for Cyber Security lists "WordPress Core - Prior to 7.1.4" as affected. Release 7.1.4 fixes 22 vulnerabilities in total, and each older branch is affected by a different number of them. WordPress.org does not say which of the 22 apply to each branch, so the simple rule is: if your site runs a version lower than the fixed version for your branch below, update.
Which WordPress version fixes CVE-2026-119977?
Minimum fixed versions, from WordPress.org (checked November 6, 2026):
| Your branch | Update to at least |
|---|---|
| 7.1 | 7.1.4 |
| 7.0 | 7.0.8 |
| 6.9 | 6.9.11 |
| 6.8 | 6.8.12 |
| 6.7 | 6.7.11 |
| 6.6 | 6.6.11 |
| 6.5 | 6.5.14 |
| 6.4 | 6.4.14 |
| 6.3 | 6.3.14 |
| 6.2 | 6.2.15 |
| 6.1 | 6.1.16 |
| 6.0 | 6.0.18 |
| 5.9 | 5.9.20 |
| 5.8 | 5.8.19 |
| 5.7 | 5.7.21 |
| 5.6 | 5.6.23 |
| 5.5 | 5.5.24 |
| 5.4 | 5.4.25 |
| 5.3 | 5.3.27 |
| 5.2 | 5.2.30 |
| 5.1 | 5.1.28 |
| 5.0 | 5.0.31 |
| 4.9 | 4.9.35 |
| 4.8 | 4.8.34 |
| 4.7 | 4.7.39 |
WordPress 4.6 and earlier no longer receive security updates, so move to a supported version. WordPress.org also notes that only the most recent version is actively supported, which makes 7.1.4 the best target.
What a "time-of-check time-of-use race condition" means
A TOCTOU bug happens when software checks something and then acts on it a moment later, but the situation changes in between. An everyday comparison: a cashier checks that your card has enough money, then charges it a moment later. If the balance is spent somewhere else in that gap, the charge goes ahead based on a check that is no longer true.
In software, an attacker tries to slip a change into that tiny gap. That is why these bugs are called "race conditions": the attacker is racing the program.
For this flaw, WordPress.org says the risk exists "during the upgrade window", while a core update is running. The researcher explains that an attacker who wins the race can get a malicious configuration file (wp-config.php) copied over the live one, take over the site and run code on the server. We are not sharing further technical detail.
What CISA's KEV listing means for you
The KEV catalog is CISA's list of vulnerabilities with evidence of real-world exploitation. Under Binding Operational Directive BOD 26-04, "Prioritizing Security Updates Based on Risk", issued June 10, 2026, US federal agencies must prioritize rapid fixes for high-risk vulnerabilities on that list. The directive also expects agencies to check whether attackers got in before the patch was applied.
BOD 26-04 binds only federal civilian agencies, but CISA says every organization, private companies included, benefits from prioritizing KEV fixes. Don't wait for your next maintenance window.
What you should do
- Check your WordPress version and compare it with the table above.
- Back up first. Take a full backup of your files and database so you can roll back if something breaks.
- Update to 7.1.4, or at least the fixed version for your branch.
- Confirm the new version after the update finishes.
- Update your plugins and themes as well.
- If your host manages updates for you, don't assume it's done. Ask your host whether your site is on a fixed version.
- Check for signs of compromise, using the section below. Updating does not remove anyone who already got in.
Check your current version
Log in to your admin area and open Dashboard > Updates, which WordPress.org names as the place to update. If WordPress offers a newer release for your site, you are not on the latest fixed version yet.
Update WordPress Core from Dashboard > Updates
On the Updates screen, click Update Now. You can also download WordPress 7.1.4 from WordPress.org and install it manually.
Automatic background updates and managed hosts
WordPress.org says sites that support automatic background updates will start the update on their own. Still confirm the version afterwards. On managed hosting, each host handles updates differently, so check with yours.
How to tell if your site was already compromised
The researcher's description of the attack points to specific things to check:
- Unknown administrator accounts. Review every account with administrator rights and remove any you don't recognize.
- Unfamiliar plugins that you did not install.
- A changed
wp-config.php, especially database settings pointing to a database you don't recognize. - Content or settings you didn't create, or your site suddenly looking like a different or empty install.
- Unexpected redirects, pop-ups or downloads that visitors report.
If you find signs of compromise:
- Restore the site from a clean backup taken before the problem started.
- Update WordPress Core, plugins and themes immediately after restoring.
- Change every related password: WordPress admin accounts, hosting control panel, database and FTP/SFTP.
- Tell your host. They may be able to see logs that you can't.
How to stay safe when your site shares files
If your WordPress site offers downloads, a compromised site can swap your files for harmful ones. Check that each download link still points to the file you expect. Visitors can follow our guide on how to check if a file is safe before you open it.
Some site owners choose to host downloads outside their WordPress install. InvisHosting is one free option. Every upload is scanned with VirusTotal, suspicious files are quarantined, and executables and other dangerous file types are blocked. Files can be up to 300 MB each. Keep in mind that anyone with a file's link can download it, and files are not end-to-end encrypted, so encrypt sensitive files before uploading.
Sources
- WordPress 7.1.4 – WordPress News (published October 28, 2026)
- Version 7.1.4 – WordPress.org Documentation (HelpHub; fixed versions by branch)
- WordPress security advisory (AV26-1117), Canadian Centre for Cyber Security, November 3, 2026
- CISA Adds One Known Exploited Vulnerability to Catalog, November 3, 2026
- Reducing the Significant Risk of Known Exploited Vulnerabilities (CISA; BOD 26-04)
- CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 13, 2026 (BOD 26-04 wording)
- CVE-2026-119977: When Updating WordPress Becomes the Vulnerability (Picus Security)
This article was written with AI assistance from the sources listed above and checked automatically against them.