{
  "id": "wordpress-upgrade-window",
  "url": "https://ohshit.app/incidents/wordpress-upgrade-window/",
  "title": "CISA lists WordPress upgrade-window RCE as exploited; patch and investigate",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-28",
  "date_is_approximate": false,
  "updated": "2026-11-03",
  "tags": [
    "WordPress",
    "RCE",
    "race condition"
  ],
  "ecosystems": [
    "php"
  ],
  "summary": "CISA confirms active exploitation of WordPress’s upgrade-window RCE and requires forensic triage, with a November 6 federal due date. Install 7.1.4 or the branch backport. The race requires a full-package update and publicly executable staging files; victim counts remain unknown.",
  "splash": "Unpatched WordPress 4.7–7.1.3 during full-package updates with a web-accessible, PHP-executable staging tree",
  "wipe": "Install 7.1.4 or the branch security backport; protect staging access during updates and verify the deployed version",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [
    {
      "id": "CVE-2026-119977",
      "score": 8.1,
      "name": "Unauthenticated staged-installer race",
      "description": "An attacker can run server code by reaching temporary installer files before update cleanup; no account is required."
    }
  ],
  "fixed": [
    {
      "product": "WordPress 7.1",
      "branch": "7.1",
      "version": "7.1.4"
    },
    {
      "product": "WordPress 7.0",
      "branch": "7.0",
      "version": "7.0.8"
    },
    {
      "product": "WordPress 6.9",
      "branch": "6.9",
      "version": "6.9.11"
    },
    {
      "product": "WordPress 6.8",
      "branch": "6.8",
      "version": "6.8.12"
    },
    {
      "product": "WordPress 6.7",
      "branch": "6.7",
      "version": "6.7.11"
    },
    {
      "product": "WordPress 6.6",
      "branch": "6.6",
      "version": "6.6.11"
    },
    {
      "product": "WordPress 6.5",
      "branch": "6.5",
      "version": "6.5.14"
    },
    {
      "product": "WordPress 6.4",
      "branch": "6.4",
      "version": "6.4.14"
    },
    {
      "product": "WordPress 6.3",
      "branch": "6.3",
      "version": "6.3.14"
    },
    {
      "product": "WordPress 6.2",
      "branch": "6.2",
      "version": "6.2.15"
    },
    {
      "product": "WordPress 6.1",
      "branch": "6.1",
      "version": "6.1.16"
    },
    {
      "product": "WordPress 6.0",
      "branch": "6.0",
      "version": "6.0.18"
    },
    {
      "product": "WordPress 5.9",
      "branch": "5.9",
      "version": "5.9.20"
    },
    {
      "product": "WordPress 5.8",
      "branch": "5.8",
      "version": "5.8.19"
    },
    {
      "product": "WordPress 5.7",
      "branch": "5.7",
      "version": "5.7.21"
    },
    {
      "product": "WordPress 5.6",
      "branch": "5.6",
      "version": "5.6.23"
    },
    {
      "product": "WordPress 5.5",
      "branch": "5.5",
      "version": "5.5.24"
    },
    {
      "product": "WordPress 5.4",
      "branch": "5.4",
      "version": "5.4.25"
    },
    {
      "product": "WordPress 5.3",
      "branch": "5.3",
      "version": "5.3.27"
    },
    {
      "product": "WordPress 5.2",
      "branch": "5.2",
      "version": "5.2.30"
    },
    {
      "product": "WordPress 5.1",
      "branch": "5.1",
      "version": "5.1.28"
    },
    {
      "product": "WordPress 5.0",
      "branch": "5.0",
      "version": "5.0.31"
    },
    {
      "product": "WordPress 4.9",
      "branch": "4.9",
      "version": "4.9.35"
    },
    {
      "product": "WordPress 4.8",
      "branch": "4.8",
      "version": "4.8.34"
    },
    {
      "product": "WordPress 4.7",
      "branch": "4.7",
      "version": "4.7.39"
    },
    {
      "product": "WordPress 4.6 and earlier",
      "version": "none",
      "status": "No security updates; migrate"
    }
  ],
  "checklist": [
    {
      "title": "Patch every installation and verify completion",
      "hint": "Use Dashboard → Updates → Update Now, then verify the running release. Check automatic updates actually completed. Only the latest WordPress branch is actively supported; older branches receive courtesy security backports. Migrate 4.6 and earlier."
    },
    {
      "title": "Protect the update window",
      "hint": "Where you control the web server, deny public HTTP access to wp-content/upgrade before updating and verify the restriction. Do not delay patching if you cannot configure this. Wordfence users need Extended Protection for direct PHP requests; paid tiers received the rule October 28, Free receives it November 27. A rule is not a replacement for the update."
    },
    {
      "title": "Investigate prior exposure",
      "hint": "Review web logs for unexpected PHP requests under wp-content/upgrade, including staged setup-config.php; check unfamiliar administrators, plugins and PHP files, and scan after updating. Preserve suspicious evidence for investigation. A request match alone does not prove code execution; the report publishes no attacker IP or hash list. CISA now marks forensic triage required. Applicable FCEB agencies must follow BOD 26-04 and its implementation/triage guidance by the catalog’s November 6 due date; other operators should prioritize the same exposure review. Patching does not establish that an earlier compromise is removed."
    }
  ],
  "sources": [
    {
      "name": "WordPress security release",
      "url": "https://wordpress.org/news/2026/10/wordpress-7-1-4/",
      "primary": true
    },
    {
      "name": "WordPress detailed release and branch backports",
      "url": "https://wordpress.org/documentation/wordpress-version/version-7-1-4/",
      "primary": true
    },
    {
      "name": "Wordfence original research and remediation",
      "url": "https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/",
      "primary": true
    },
    {
      "name": "Wordfence vulnerability record",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution?asset_slug=wordpress",
      "primary": true
    },
    {
      "name": "NHS England CC-4884",
      "url": "https://digital.nhs.uk/cyber-alerts/2026/cc-4884",
      "primary": true
    },
    {
      "name": "CISA November 3 KEV alert",
      "url": "https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog",
      "says": "Adds CVE-2026-119977 based on active-exploitation evidence.",
      "primary": true
    },
    {
      "name": "CISA live KEV catalog",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "says": "November 3 addition; November 6 due date; forensicTriage Yes, ransomware use Unknown.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "CISA KEV confirms active exploitation; forensic triage is required.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 28, 2026",
      "title": "WordPress publishes the security release"
    },
    {
      "date": "Oct 29, 2026",
      "title": "Wordfence reports staged-installer exploitation attempts"
    },
    {
      "date": "Nov 3, 2026",
      "title": "CISA adds the installer race to KEV",
      "body": "CISA cites evidence of active exploitation, sets a November 6 remediation due date and marks forensic triage required. No victim count is supplied."
    }
  ],
  "body_markdown": "The October 28 release groups stored XSS, Interactivity API, disclosure and authorization fixes with the installer race and a certificate-trust update. Their permissions and affected branches differ; the unauthenticated RCE prerequisite must not be applied to every sibling issue.\n\nThe attacker must locate the temporary tree and finish before cleanup, typically seconds in Wordfence's testing. An idle WordPress installation is not continuously exposed through this race. L4 reflects active targeting of a widely deployed platform, not a demonstrated mass compromise. No victim count is established.\n\n\n**November 3 exploitation update:** CISA’s KEV addition supersedes the earlier attempt-only evidence assessment. It confirms active exploitation of this CVE, without specifying successful victims or changing the upgrade-window prerequisites. The catalog’s November 6 due date and BOD 26-04 obligations apply to covered federal agencies; ransomware use is listed as unknown. All branch fixes above remain necessary."
}