CVE-2026-119977: Why Patching WordPress Can Briefly Make Your Site More Vulnerable
A critical race-condition vulnerability tracked as CVE-2026-119977 affects WordPress versions 4.7 through 7.1.3, allowing unauthenticated attackers to execute arbitrary PHP code on the server during the core update process. The flaw arises because WordPress's updater unpacks new release files—including the installer—into a predictable temporary folder under wp-content/upgrade using the old, unpatched code. An attacker who can determine or predict the folder name and access the installer within a narrow window (often just seconds) can establish a rogue WordPress environment, execute server-side code with web server permissions, and read or write files in the live site. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, and Wordfence observed attack attempts beginning within nine minutes of publishing a firewall rule. Exploit code has since appeared in public GitHub repositories. This incident underscores a dangerous class of supply-chain-adjacent risk: the remediation pathway itself becomes a momentary attack surface. As automated background updates become the norm across CMS platforms and cloud-native workloads, defenders must account for transient exposure windows during patching cycles—a challenge that traditional perimeter controls and signature-based tools are poorly positioned to address in isolation.
Kill Chain
