CVE-2026-119977 lets attackers run code on a server while WordPress updates itself. CISA has added it to its exploited-vulnerability catalog; the fix shipped in WordPress 7.1.4.
A flaw in WordPress core that lets attackers execute code on the server while a site is being updated has been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2026-119977, it carries a CVSS score of 8.1.
What happened
The issue lies in how WordPress handles temporary files while applying a core update. During the update, files are extracted into wp-content/upgrade/. If that directory is reachable from the web and PHP runs there, an attacker can reach the temporary installer. Because the installer cannot see the live configuration file, it treats the site as unconfigured. The attacker can then supply database credentials they control and have a fresh configuration file written. On unpatched versions that file is copied over the live configuration, allowing the attacker to create an administrator account and run PHP code on the server.
The attack only works if the attacker hits the short window while the update is running, which is why the flaw is classed as a time-of-check time-of-use (TOCTOU) race condition. No account on the site is required.
Why it matters
Umut Bayram of Picus Security, who reported the flaw, traced the underlying behaviour back to WordPress 2.7 from 2008. Public advisories list the affected range as 4.7 through 7.1.3. The fix shipped in WordPress 7.1.4 on 28 October 2026; it randomises the temporary directory name and stops a staged configuration file from overwriting the live one.
Exploitation began shortly after the patch was published. Security vendor Wordfence reported more than 18,500 requests aimed at staged installer paths in the first 21 hours after disclosure. CISA added the vulnerability to the KEV catalog on 3 November 2026 and set 6 November 2026 as the remediation deadline for US federal agencies.
What this means for Turkish SMEs
A large share of corporate websites in Turkey run on WordPress. Those sites are often the most visible part of a company's identity, and they frequently share a server with mail or file services. A compromised website is not only a reputational problem: personal data submitted through contact and application forms can be exposed as well. A breach involving personal data can trigger the obligation to notify the Turkish Data Protection Authority within 72 hours under Law No. 6698.
In smaller companies the website is usually built by an outside agency and then left unattended. Even where automatic updates are enabled, a server that is not configured correctly turns the moment of the update itself into a window of exposure.
What Kamer Bilişim recommends
- Check your version and move to 7.1.4. Confirm the version shown in the admin dashboard. Every installation between 4.7 and 7.1.3 is affected; very old installations in the 2.7-4.6 range received no fix at all and need to be migrated to the current release.
- Block web access to the upgrade directory. Using your server configuration or the root .htaccess file, deny external access to wp-content/upgrade/ and verify that the path returns a 403. This closes the window that the attack depends on.
- Back up before updating, and verify afterwards. Take a file and database backup before the update. Afterwards, review the list of administrator accounts, the installed plugins and the modification date of wp-config.php. An unexpected administrator or a new plugin should be treated as a compromise.
We provide hosting, server maintenance and security configuration services to organisations across the Anatolian side of Istanbul, on site and remotely. To make sure your web server is current and properly hardened, reach us through our contact page.
Source: The Hacker News, Hackread, CISA Known Exploited Vulnerabilities Catalog
Source: The Hacker News