WordPress Security Vulnerability CVE-2026-119977 Exposes Sites During the Patching Process

The digital landscape is currently grappling with a sophisticated security challenge affecting millions of websites powered by WordPress. A critical vulnerability, tracked as CVE-2026-119977, has been identified in the platform’s core update mechanism. While the vulnerability itself is severe, the discovery by Picus Security researcher Umut Bayram reveals a paradoxical security gap: the very process intended to secure a website can, under specific conditions, leave it open to remote code execution (RCE) attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, signaling the urgency for site administrators to implement defensive measures beyond standard patching.

The Anatomy of the Flaw

The vulnerability affects WordPress versions ranging from 4.7 through 7.1.3. The root cause lies in the way WordPress manages the staging of update files. When a site undergoes a core update—particularly when a "complete package" is utilized—the system downloads and extracts a fresh copy of the WordPress core into a temporary directory located within the wp-content/upgrade folder.

Crucially, this temporary directory often contains the full WordPress installer. Because this folder resides within the web-accessible directory structure of the host server, it is potentially reachable by external actors. If an attacker can accurately predict or discover the name of this temporary folder during the brief window of the update process, they can execute the installer script. By doing so, they could potentially overwrite the site’s configuration file (wp-config.php), redirect the database connection, and gain unauthorized control over the server environment.

A Paradoxical Patching Risk

The most alarming aspect of this security incident is the discovery that even the security update (version 7.1.4) can be exploited during installation. As Umut Bayram noted in his technical analysis, the update process relies on the existing, unpatched code to orchestrate the installation of the new, patched files.

On sites running WordPress 5.9 or newer, the legacy update logic often assigns a predictable name to the temporary directory based on the downloaded file. Even when the update is intended to rectify the vulnerability, the initial phase of that update process still utilizes the vulnerable code paths. Consequently, a threat actor monitoring server traffic or timing their exploit attempts with surgical precision could hijack the installation process, gaining RCE before the system completes the update and deletes the temporary files.

Chronology of the Discovery and Response

The timeline of this vulnerability reflects the rapid escalation from discovery to widespread exploitation.

• Initial Discovery: Security researchers identified the flaw in the core updater, tracing its lineage back to legacy code that has existed for nearly two decades, with roots potentially reaching back to WordPress 2.7 (2008).
• Release of 7.1.4: WordPress officially released version 7.1.4 and backported security fixes to earlier versions to address the RCE vector.
• Active Exploitation: Shortly after the disclosure, security firms like Wordfence observed a surge in scanning activity. Attackers were observed targeting sites within minutes of the patch release, suggesting that malicious actors were utilizing the vulnerability to catch administrators in the act of updating their sites.
• CISA Intervention: By late October, the frequency and success of these attacks compelled CISA to add the CVE to its KEV list, mandating that federal agencies and recommending that private entities prioritize remediation.

Technical Implications and Attack Surface

The severity of this flaw is underscored by its CVSS score of 8.1 out of 10. While WordPress’s own security advisory characterized the risk as "low," industry experts argue that the nature of the exploit—which bypasses traditional authentication by targeting the installation process—presents a high-impact threat to data integrity and server confidentiality.

The attack surface varies depending on the update method:

1. Complete Packages: These are the most vulnerable, as they contain the full installer files. Sites migrating from older major versions to newer ones are almost exclusively using these.
2. Partial Packages: These are generally safer as they only contain modified files. However, the system may revert to a complete package if core files have been modified or if the integrity check fails, inadvertently exposing the site to the risk.
3. Automatic Updates: Sites configured for background updates are not immune. They utilize the same vulnerable update code, meaning an automated update could be the very event that triggers a compromise if an attacker is monitoring the server.

Recommended Defensive Strategies

Given that simply clicking "update" may not be sufficient to avoid the risk during the transition period, security professionals are advocating for manual, "out-of-band" update procedures.

Blocking Web Access to /upgrade:
The most effective immediate mitigation is to configure the web server (Nginx or Apache) to deny public access to the wp-content/upgrade directory. Because the WordPress core updater functions by interacting with the filesystem directly, it does not require web-based access to this folder to perform its duties. This creates a "dead zone" for attackers who rely on HTTP requests to trigger the installer.

Manual Updates Outside the Web Root:
For high-security environments, the recommendation is to perform updates manually. This involves:

• Backing up the current site and database.
• Unpacking the WordPress update package in a directory that is not accessible via the public internet (i.e., outside the public_html or www folder).
• Copying the core files into the site directory while explicitly excluding the wp-config.php file and the wp-content folder to ensure no configuration data is overwritten.
• Running the database update script once the new files are in place.

This process ensures that no temporary installation directory is ever exposed to the public-facing web server, effectively neutralizing the attacker’s ability to locate or execute the installer.

The Broader Impact on CMS Security

The persistence of this vulnerability—which has effectively existed for the better part of 18 years—highlights a systemic challenge in software maintenance: the "technical debt" of legacy code. Many core functionalities in massive, widely-deployed Content Management Systems (CMS) are built upon architectural decisions made in a vastly different threat landscape.

When researchers find vulnerabilities in such foundational code, the remediation process becomes fraught with danger, as the mechanism for repair is often tied to the very logic that is being repaired. This incident serves as a poignant reminder that even "official" updates carry risk, particularly when those updates require the execution of complex, high-privilege operations like modifying the site’s core configuration.

For the vast majority of users who rely on the simplicity of the "one-click update" button, this vulnerability introduces a moment of friction. The move toward more robust, isolated update containers or the implementation of atomic updates—where the file replacement happens at a level below the application logic—is likely to become a focal point of future development for the WordPress core team.

Conclusion and Future Outlook

As of early November, the threat remains active. The presence of public exploit scripts on platforms like GitHub has lowered the barrier to entry for attackers, allowing even unskilled individuals to probe for vulnerable servers. While the patch in version 7.1.4 represents the correct path forward, administrators must remain vigilant.

The lessons learned from CVE-2026-119977 are twofold: first, that security is not a static state but a process that must be managed with care; and second, that the integrity of the update pipeline is just as critical as the software itself. As the digital ecosystem continues to rely heavily on WordPress to power a significant portion of the internet, the demand for more transparent, secure, and verifiable update mechanisms will only grow. For now, site owners are urged to review their server configurations, monitor their logs for unauthorized access to the /upgrade directory, and adopt the more rigorous manual update processes until the ecosystem stabilizes.