WordPress Upgrade Flaw Allows Remote Code Execution
Published · WordPress · 1 CVE · NVD and CISA KEV checked November 5, 2026
In short WordPress has patched an upgrade flaw that lets attackers run server code without signing in; CISA lists it as exploited.
What happened
WordPress has released fixes for a flaw in its WordPress Core upgrade process that can let an attacker run code on the server without signing in. Think of an upgrade as a delivery: temporary materials are left in a predictable spot that someone outside can reach before the delivery is finished. Here, the exposure involves temporary staging locations used during full-package core upgrades.
The vulnerability, CVE-2026-119977, is known to be exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-11-03. The catalog lists a due date of 2026-11-06 and identifies known ransomware use as Unknown. That designation leaves ransomware involvement unresolved; it does not change the confirmed exploitation status.
NVD published its entry on 2026-10-31 and rates the vulnerability High. The vendor's advisory identifies affected releases and corresponding fixes across multiple WordPress branches. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-11-04.
Technical details
NVD associates CVE-2026-119977 with CWE-367, Time-of-check Time-of-use (TOCTOU) Race Condition. This weakness category concerns timing: a resource's condition can change between when software checks it and when software uses it. For this WordPress flaw, the relevant exposure occurs during the upgrade process.
The root cause involves predictable staging locations that are accessible through the web during full-package core upgrades. Staging is the temporary holding area used while an upgrade is being prepared or applied. Because these locations can be anticipated and reached, an attacker may be able to execute code on the server while the upgrade is underway.
The described attack requires an affected WordPress installation undergoing a full-package core upgrade and attacker access to the exposed staging location during that window. Authentication is not required, meaning the attacker does not need to sign in. Remote code execution means the attacker can cause the server to run code. The description does not establish that the same opportunity remains available outside the upgrade window or specify the permissions that executed code would have.
NVD assigns a CVSS version 3.1 score of 8.1, with High severity. CVSS is a standardized way to describe a vulnerability's technical severity; it is not a prediction that a particular site will be compromised. CISA's KEV listing supplies the separate, practical finding that this vulnerability has already been exploited.
Who is affected
Everyday users
If you use a WordPress-powered site as a visitor, the affected software runs on the site's server. The update needs to be handled by whoever maintains that WordPress installation. Updating your own device does not apply the server-side WordPress fix.
If you own a WordPress site but someone else manages it, ask that maintainer to confirm the installed release and the applicable fixed release. The lack of a sign-in requirement matters: an attacker does not need a WordPress account to exploit the described upgrade exposure.
Developers
Developers who maintain WordPress deployments should pay attention to workflows that perform full-package core upgrades. The vulnerability concerns temporary staging behavior during that operation, so reviewing only the site's normal page-serving behavior would miss the condition described in the advisory.
Use the vendor's branch-specific version table when planning the change. A higher-looking version in a different branch is not enough to establish that the fix is present. For example, 7.0.7 is affected and 7.0.8 is fixed in its branch, while 7.1.3 is affected and 7.1.4 is fixed in its branch.
Server and IT admins
Server and IT administrators should identify installations in the affected ranges and arrange the corresponding WordPress updates. The exposure happens during an upgrade, so the upgrade procedure itself deserves attention alongside the version being deployed. Follow the update steps in the vendor's advisory.
Treat the known exploitation status as a reason to prioritize this work. CISA's listing does not establish that any particular installation has been compromised, and the advisory details do not identify attackers, campaigns, or specific post-exploitation activity.
What to do now
- Identify the installed WordPress version on each installation you manage and compare it with the affected ranges below. Each range includes both endpoints, and each fixed release applies to its corresponding branch.
- For the older branches, update affected installations as follows: 4.7.0 through 4.7.38 to 4.7.39 and later; 4.8.0 through 4.8.33 to 4.8.34 and later; 4.9.0 through 4.9.34 to 4.9.35 and later; 5.0.0 through 5.0.30 to 5.0.31 and later; 5.1.0 through 5.1.27 to 5.1.28 and later; 5.2.0 through 5.2.29 to 5.2.30 and later; 5.3.0 through 5.3.26 to 5.3.27 and later; 5.4.0 through 5.4.24 to 5.4.25 and later; 5.5.0 through 5.5.23 to 5.5.24 and later.
- For the next group of branches, update affected installations as follows: 5.6.0 through 5.6.22 to 5.6.23 and later; 5.7.0 through 5.7.20 to 5.7.21 and later; 5.8.0 through 5.8.18 to 5.8.19 and later; 5.9.0 through 5.9.19 to 5.9.20 and later; 6.0.0 through 6.0.17 to 6.0.18 and later; 6.1.0 through 6.1.15 to 6.1.16 and later; 6.2.0 through 6.2.14 to 6.2.15 and later; 6.3.0 through 6.3.13 to 6.3.14 and later.
- For the remaining listed branches, update affected installations as follows: 6.4.0 through 6.4.13 to 6.4.14 and later; 6.5.0 through 6.5.13 to 6.5.14 and later; 6.6.0 through 6.6.10 to 6.6.11 and later; 6.7.0 through 6.7.10 to 6.7.11 and later; 6.8.0 through 6.8.11 to 6.8.12 and later; 6.9.0 through 6.9.10 to 6.9.11 and later; 7.0.0 through 7.0.7 to 7.0.8 and later; 7.1.0 through 7.1.3 to 7.1.4 and later.
- Follow the update steps in the vendor's advisory, including any guidance relevant to full-package core upgrades. Do not assume the absence of an attacker account removes the exposure.
- After the update completes, confirm the running WordPress version against the fixed release for its branch. If a hosting provider or another team handles updates, obtain that confirmation from them.
How to confirm the fix
- Confirm the installed WordPress release after the update finishes, rather than relying only on the version selected for deployment.
- Match that installed release to the vendor's fixed release for the same branch. For example, 6.8.11 remains affected, while 6.8.12 is the listed fixed release for that branch.
- Check every installation included in your update work. Version confirmation establishes whether the listed fix is installed; it does not establish whether exploitation occurred before the update.
NVD scores and CISA KEV status
Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-119977 (added November 3, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.
| CVE | CVSS | Severity | Weakness (CWE) | KEV |
|---|---|---|---|---|
| CVE-2026-119977 | 8.1 (v3.1) | High | CWE-367 | Listed |
Affected products and fixed versions 25 rows
| Product | Affected versions | Fixed version / action | CVE |
|---|---|---|---|
| WordPress | >= 4.7.0 and <= 4.7.38 | 4.7.39 and later | CVE-2026-119977 |
| WordPress | >= 4.8.0 and <= 4.8.33 | 4.8.34 and later | CVE-2026-119977 |
| WordPress | >= 4.9.0 and <= 4.9.34 | 4.9.35 and later | CVE-2026-119977 |
| WordPress | >= 5.0.0 and <= 5.0.30 | 5.0.31 and later | CVE-2026-119977 |
| WordPress | >= 5.1.0 and <= 5.1.27 | 5.1.28 and later | CVE-2026-119977 |
| WordPress | >= 5.2.0 and <= 5.2.29 | 5.2.30 and later | CVE-2026-119977 |
| WordPress | >= 5.3.0 and <= 5.3.26 | 5.3.27 and later | CVE-2026-119977 |
| WordPress | >= 5.4.0 and <= 5.4.24 | 5.4.25 and later | CVE-2026-119977 |
| WordPress | >= 5.5.0 and <= 5.5.23 | 5.5.24 and later | CVE-2026-119977 |
| WordPress | >= 5.6.0 and <= 5.6.22 | 5.6.23 and later | CVE-2026-119977 |
| WordPress | >= 5.7.0 and <= 5.7.20 | 5.7.21 and later | CVE-2026-119977 |
| WordPress | >= 5.8.0 and <= 5.8.18 | 5.8.19 and later | CVE-2026-119977 |
| WordPress | >= 5.9.0 and <= 5.9.19 | 5.9.20 and later | CVE-2026-119977 |
| WordPress | >= 6.0.0 and <= 6.0.17 | 6.0.18 and later | CVE-2026-119977 |
| WordPress | >= 6.1.0 and <= 6.1.15 | 6.1.16 and later | CVE-2026-119977 |
| WordPress | >= 6.2.0 and <= 6.2.14 | 6.2.15 and later | CVE-2026-119977 |
| WordPress | >= 6.3.0 and <= 6.3.13 | 6.3.14 and later | CVE-2026-119977 |
| WordPress | >= 6.4.0 and <= 6.4.13 | 6.4.14 and later | CVE-2026-119977 |
| WordPress | >= 6.5.0 and <= 6.5.13 | 6.5.14 and later | CVE-2026-119977 |
| WordPress | >= 6.6.0 and <= 6.6.10 | 6.6.11 and later | CVE-2026-119977 |
| WordPress | >= 6.7.0 and <= 6.7.10 | 6.7.11 and later | CVE-2026-119977 |
| WordPress | >= 6.8.0 and <= 6.8.11 | 6.8.12 and later | CVE-2026-119977 |
| WordPress | >= 6.9.0 and <= 6.9.10 | 6.9.11 and later | CVE-2026-119977 |
| WordPress | >= 7.0.0 and <= 7.0.7 | 7.0.8 and later | CVE-2026-119977 |
| WordPress | >= 7.1.0 and <= 7.1.3 | 7.1.4 and later | CVE-2026-119977 |
The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.
Frequently asked questions
Does an attacker need a WordPress account?
No. The described vulnerability can be exploited without authentication during the full-package core upgrade window, when the vulnerable staging location is accessible.
Is this vulnerability actually being exploited?
Yes. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 2026-11-03. The catalog lists known ransomware use as Unknown, so it does not establish ransomware involvement.
Does the upgrade timing mean I should leave WordPress unpatched?
No. Affected releases need the applicable fix. Because the vulnerable behavior occurs during full-package core upgrades, follow the update steps in the vendor's advisory and confirm the installed version afterward.
References
- WordPress advisory: https://wordpress.org/news/2026/10/wordpress-7-1-4/
- WordPress advisory: https://wordpress.org/documentation/wordpress-version/version-7-1-4/
- NVD: CVE-2026-119977
- CISA Known Exploited Vulnerabilities catalog
- Also reported by KISA (Korea Internet & Security Agency) on November 4, 2026: KISA advisory (Korean)
How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.