CVE-2026-119977CVSS 8.1Unauthenticated staged-installer race
An attacker can run server code by reaching temporary installer files before update cleanup; no account is required.
CISA lists WordPress upgrade-window RCE as exploited; patch and investigate
CISA confirms active exploitation of WordPress’s upgrade-window RCE and requires forensic triage, with a November 6 federal due date. Install 7.1.4 or the branch backport. The race requires a full-package update and publicly executable staging files; victim counts remain unknown.
- Disclosed
- Oct 28, 2026
- Updated Nov 3, 2026
- Severity
- CVSS 8.1
- 1 CVE tracked here
- Splash zone
- Unpatched WordPress 4.7–7.1.3 during full-package updates with a web-accessible, PHP-executable staging tree
- php
- In the wild
- Yes
- CISA KEV confirms active exploitation; forensic triage is required.
What happened
The October 28 release groups stored XSS, Interactivity API, disclosure and authorization fixes with the installer race and a certificate-trust update. Their permissions and affected branches differ; the unauthenticated RCE prerequisite must not be applied to every sibling issue.
The attacker must locate the temporary tree and finish before cleanup, typically seconds in Wordfence’s testing. An idle WordPress installation is not continuously exposed through this race. L4 reflects active targeting of a widely deployed platform, not a demonstrated mass compromise. No victim count is established.
November 3 exploitation update: CISA’s KEV addition supersedes the earlier attempt-only evidence assessment. It confirms active exploitation of this CVE, without specifying successful victims or changing the upgrade-window prerequisites. The catalog’s November 6 due date and BOD 26-04 obligations apply to covered federal agencies; ransomware use is listed as unknown. All branch fixes above remain necessary.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| WordPress 7.1 | 7.1.4 | |
| WordPress 7.0 | 7.0.8 | |
| WordPress 6.9 | 6.9.11 | |
| WordPress 6.8 | 6.8.12 | |
| WordPress 6.7 | 6.7.11 | |
| WordPress 6.6 | 6.6.11 | |
| WordPress 6.5 | 6.5.14 | |
| WordPress 6.4 | 6.4.14 | |
| WordPress 6.3 | 6.3.14 | |
| WordPress 6.2 | 6.2.15 | |
| WordPress 6.1 | 6.1.16 | |
| WordPress 6.0 | 6.0.18 | |
| WordPress 5.9 | 5.9.20 | |
| WordPress 5.8 | 5.8.19 | |
| WordPress 5.7 | 5.7.21 | |
| WordPress 5.6 | 5.6.23 | |
| WordPress 5.5 | 5.5.24 | |
| WordPress 5.4 | 5.4.25 | |
| WordPress 5.3 | 5.3.27 | |
| WordPress 5.2 | 5.2.30 | |
| WordPress 5.1 | 5.1.28 | |
| WordPress 5.0 | 5.0.31 | |
| WordPress 4.9 | 4.9.35 | |
| WordPress 4.8 | 4.8.34 | |
| WordPress 4.7 | 4.7.39 | |
| WordPress 4.6 and earlier | No fix | No security updates; migrate |
Crime-scene timeline
Oct 28, 2026
WordPress publishes the security release
Oct 29, 2026
Wordfence reports staged-installer exploitation attempts
Nov 3, 2026
CISA adds the installer race to KEV
CISA cites evidence of active exploitation, sets a November 6 remediation due date and marks forensic triage required. No victim count is supplied.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- WordPress security releasePrimary
- WordPress detailed release and branch backportsPrimary
- Wordfence original research and remediationPrimary
- Wordfence vulnerability recordPrimary
- NHS England CC-4884Primary
- CISA November 3 KEV alertPrimaryAdds CVE-2026-119977 based on active-exploitation evidence.
- CISA live KEV catalogPrimaryNovember 3 addition; November 6 due date; forensicTriage Yes, ransomware use Unknown.