/cards/ once it crosses the publish bar. Status: superseded.WordPress Core CVE-2026-119977 upgrade race condition listed in CISA KEV as exploited
CISA lists CVE-2026-119977, a WordPress Core race condition during full-package core upgrades, as known exploited, with a federal due date of 2026-11-06. Today: inventory WordPress sites, patch to the fixed release, and hunt web logs for requests into upgrade staging paths.
Triage: CISA confirms exploitation of an unauthenticated code-execution flaw in internet-facing WordPress Core, with a 2026-11-06 due date [S1].
CISA KEV, a primary source, confirms active exploitation [S1][S2]. Technical detail is thin: no source reviewed gives payloads, IoCs or attacker behaviour, and the version range and fix come from pipeline exposure data citing advisories not among S1–S3.
What happened
- CISA added CVE-2026-119977, a WordPress Core TOCTOU race condition, to the Known Exploited Vulnerabilities catalog on 2026-11-03 [S1][S2].
- The flaw could let unauthenticated attackers execute code on the server during full-package core upgrades by exploiting predictable web-accessible staging paths [S1].
- The KEV due date is 2026-11-06, and the entry requires forensic triage under BOD 26-04 [S1].
- Secondary reporting relays CISA's confirmation of exploitation; the sources reviewed describe no specific attacker behaviour, payloads or IoCs [S3].
Timeline
| 2026-11-03 | CVE-2026-119977 added to CISA KEV catalog S1 |
| 2026-11-03 | CISA alert announces one KEV addition S2 |
| 2026-11-04 | The Hacker News reports CISA-confirmed exploitation S3 |
| 2026-11-06 | KEV remediation due date for federal agencies S1 |
Detect
Web requests into WordPress upgrade staging paths · Web server / reverse proxy / WAF access logs
index=* "/wp-content/upgrade" | rex field=_raw "(?<req_path>/wp-content/upgrade[^\s\"?]*)" | search req_path="*.php*" | stats count earliest(_time) as first_seen latest(_time) as last_seen values(status) as status by host, req_path | convert ctime(first_seen) ctime(last_seen)
A hit means: A client requested a PHP file inside the upgrade staging area, which matches the exploit condition [S1]. This assumes the default WordPress staging directory; the sources do not name the exact path. A 200 response from an external client during an upgrade window warrants forensic triage.
Shell or download tools spawned by the web server or PHP process · EDR / Sysmon / auditd process creation on WordPress hosts
index=* (parent_process_name="php*" OR parent_process_name="httpd" OR parent_process_name="apache2" OR parent_process_name="nginx" OR parent_process_name="w3wp.exe") (process_name="sh" OR process_name="bash" OR process_name="dash" OR process_name="curl" OR process_name="wget" OR process_name="python*" OR process_name="perl" OR process_name="nc" OR process_name="cmd.exe" OR process_name="powershell.exe") | stats count earliest(_time) as first_seen values(process) as cmdline by host, parent_process_name, process_name
A hit means: The web server executed a command, which is consistent with the code execution the KEV entry describes [S1]. Correlate the time with core upgrade windows and with Hunt 1 hits.
Verify
- True positive: an external client fetches or executes a .php file under the upgrade staging path while a core upgrade is running, then follow-on activity appears (new PHP files, web-server child processes, new admin users).
- Compare hit times with the actual core upgrade times in the WordPress or host logs; the race only exists during full-package upgrades [S1].
- Benign look-alike: WordPress itself writes and extracts files in the upgrade directory during legitimate core, plugin and theme updates.
- Benign look-alike: vulnerability scanners and uptime checks probing wp-content paths; these usually return 403 or 404 and show no execution.
- Benign look-alike: legitimate cron, WP-CLI or backup plugins invoking shell or PHP subprocesses.
Scope
Affected
- WordPress Core sites vulnerable to CVE-2026-119977 [S1]; pipeline exposure data gives 4.7.0 through 7.1.3, citing a Wordfence advisory not among S1–S3.
Only if
- A full-package core upgrade is performed, creating web-accessible staging paths during the upgrade window [S1].
Not affected if
- Core is at a fixed version (7.1.4 or later per pipeline exposure data citing a vendor release note not among S1–S3).
Fixed in: 7.1.4 (per pipeline exposure data; confirm against the WordPress release note)
Enumerate
- All WordPress instances, including marketing, campaign, and third-party or agency-hosted sites, with core version.
- Which sites ran a full-package core upgrade, and when, since the vulnerable range first applied; auto-update logs and hosting-panel history.
- Whether the upgrade/staging directory is reachable over the web on each site.
- Admin accounts, application passwords and API keys on each site.
- Credentials and secrets stored on WordPress hosts (wp-config.php database credentials, cloud keys).
Contain
- Preserve evidence first: export web access logs and snapshot the wp-content/upgrade directory and the web root before any cleanup. Deleting staging contents cannot be undone.
- Patch to the fixed release. Because the race occurs during upgrades [S1], run the upgrade with the site restricted (maintenance mode, IP allowlist or WAF deny on staging paths) if feasible. This is a precaution derived from the described mechanism, not vendor guidance.
- Until patched, avoid unattended full-package core upgrades on internet-exposed sites, or block web access to the staging directory.
- Isolate any site with a confirmed Hunt 1 or Hunt 2 hit from internal networks and databases pending forensic triage, as BOD 26-04 requires for federal agencies [S1].
Eradicate
- The sources describe no specific persistence [S1][S3]. On affected sites, check for unexpected PHP files in the web root and uploads, modified core files, rogue admin users and scheduled tasks.
- Verify core file integrity against official checksums and reinstall core from a clean package if they differ.
- Rotate database credentials, salts/keys in wp-config.php and admin passwords on any site with evidence of execution. Rotation is irreversible and will invalidate sessions.
Recover
- Before restoring traffic, validate the core version is fixed, checksums match and no unknown PHP files or admin accounts remain.
- Monitor web logs for staging-path requests and web-server child processes for at least the next upgrade cycle.
- Watch outbound connections from WordPress hosts for unexpected destinations.
Re-enter the loop when
- CISA, WordPress or a security vendor publishes IoCs, payloads or attacker infrastructure for CVE-2026-119977.
- The affected version range or fixed version changes in a vendor advisory.
- Exploitation is reported outside the full-package upgrade condition, such as plugin or theme updates.
- A hunt hit appears on a site that was believed patched or not exposed.
Debrief
- Record each WordPress site, its version, upgrade times and hunt results.
- Record the time from KEV listing (2026-11-03) to patch per site.
- Gap: no source reviewed gives the exact staging path, exploit timing or IoCs.
- Gap: the version range and fixed version come from advisories not among S1–S3.
- Gap: whether third-party or agency-hosted sites were covered by the inventory.
Detection coverage — checked automatically
| Category | Source | Status |
|---|---|---|
| Vendor | Impacted vendor / CERT advisory | published — primary source among the thread's sources: https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| Government | CISA KEV · CVE-2026-119977 | published — listed 2026-11-03, federal due 2026-11-06 |
| Reference | NVD · CVE-2026-119977 | published — published 2026-10-31, CVSS 3.1 8.1 |
| VM scanners | Qualys · CVE-2026-119977 | published — ThreatPROTECT: CISA Warns of WordPress Vulnerability Exploited in the Wild (CVE-2026-119977) |
| VM scanners | Rapid7 · CVE-2026-119977 | nothing found — entry exists, no InsightVM coverage stated |
| VM scanners | Tenable · CVE-2026-119977 | nothing found — no plugin names the CVE yet |
| EDR / endpoint VM | CrowdStrike blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | Microsoft Security blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | SentinelOne blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | SentinelOne Labs | nothing found — no post names it among the feed's 10 newest items |
| WAF / edge | Akamai blog | nothing found — no post names it among the feed's 1181 newest items |
| WAF / edge | Cloudflare WAF managed-ruleset changelog | nothing found — no post names it among the feed's 137 newest items |
| Cloud / container | Wiz blog | nothing found — no post names it among the feed's 716 newest items |
| Linux distro errata | Debian tracker · CVE-2026-119977 | published — tracker entry |
| Linux distro errata | Red Hat · CVE-2026-119977 | nothing found — Important; entry exists, no errata yet |
| IDS / research | Cisco Talos blog | nothing found — no post names it among the feed's 15 newest items |
| IDS / research | Emerging Threats open · CVE-2026-119977 | nothing found — no open rule names it (exploit, web_server, web_specific_apps sets) |
| Detection content | Elastic detection rules | published — 3 files name WordPress: rules/linux/persistence_webserver_php_file_creation_in_wordpress_plugin_dir.toml, rules/_deprecated/defense_evasion_code_injection_conhost.toml, rules/macos/privilege_escalation_user_added_to_admin_group.toml |
| Detection content | Elastic Security Labs | nothing found — no post names it among the feed's 102 newest items |
| Detection content | SigmaHQ rules | published — 17 files name WordPress: deprecated/windows/win_susp_vssadmin_ntds_activity.yml, deprecated/windows/proc_creation_win_susp_squirrel_lolbin.yml, rules/windows/file/file_event/file_event_win_iso_file_mount.yml, rules/web/proxy_generic/proxy_ua_frameworks.yml |
| Detection content | Splunk ESCU | published — 12 files name WordPress / TOCTOU: stories/wordpress_vulnerabilities.yml, detections/web/wordpress_bricks_builder_plugin_rce.yml, stories/xworm.yml, stories/clop_ransomware.yml |
| Community | Nuclei template · CVE-2026-119977 | nothing found — no template under http/cves |
| MSSP / IR firms | Arctic Wolf blog | nothing found — no post names it among the feed's 10 newest items |
| MSSP / IR firms | Huntress blog | nothing found — no post names it among the feed's 748 newest items |
| MSSP / IR firms | Rapid7 blog | nothing found — no post names it among the feed's 20 newest items |
| MSSP / IR firms | Sophos threat research | nothing found — no post names it among the feed's 15 newest items |
| Research | Unit 42 | nothing found — no post names it among the feed's 15 newest items |
Checked automatically 2026-11-04 12:54Z from public sources: 8 published, 19 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.
What a person would still look up (5)
| WAF / reverse proxy | Does a rule exist for requests to WordPress upgrade staging paths, or can a custom deny rule be added? |
| Vulnerability scanner | Does the scanner have a check for CVE-2026-119977 and the WordPress version, including authenticated version detection? |
| EDR | Is there telemetry and alerting on web-server processes spawning shells on Linux WordPress hosts? |
| File integrity monitoring | Is the WordPress web root and wp-content monitored for new PHP files? |
| Attack surface management | Are all external WordPress instances, including vendor-hosted ones, inventoried with version? |
Exposure queries — generated automatically
shodan · cve · CVE-2026-119977
vuln:CVE-2026-119977
open · Shodan tags a service with a CVE from its banner version; a paid-tier filter. Exact for this CVE, blind to a host Shodan has not fingerprinted.
0match this spelling on Shodan · 2026-11-04 — Shodan has tagged no banner with this CVE yet; its tagging follows its own version fingerprinting, not the advisory
shodan · cpe · wordpress:wordpress
cpe:"cpe:/a:wordpress:wordpress"
open · Every Wordpress service Shodan fingerprinted, any version (CPE 2.2 form of cpe:2.3:a:wordpress:wordpress). Affected per NVD: >= 4.7 < 4.7.39; >= 4.8 < 4.8.34; >= 4.9 < 4.9.35; >= 5.0 < 5.0.31; >= 5.1 < 5.1.28; >= 5.2 < 5.2.30; >= 5.3 < 5.3.27; >= 5.4 < 5.4.25.
2,278,704services internet-wide on Shodan · 2026-11-04
shodan · product · wordpress:wordpress
product:"Wordpress"
open · Banner product name, NVD's spelling; adjust if Shodan's differs. Affected per NVD: >= 4.7 < 4.7.39; >= 4.8 < 4.8.34; >= 4.9 < 4.9.35; >= 5.0 < 5.0.31; >= 5.1 < 5.1.28; >= 5.2 < 5.2.30; >= 5.3 < 5.3.27; >= 5.4 < 5.4.25.
0match this spelling on Shodan · 2026-11-04
censys · product · wordpress:wordpress
host.services: (software.product = "Wordpress")
Censys Platform host search, software as fingerprinted at layer 7. Affected per NVD: >= 4.7 < 4.7.39; >= 4.8 < 4.8.34; >= 4.9 < 4.9.35; >= 5.0 < 5.0.31; >= 5.1 < 5.1.28; >= 5.2 < 5.2.30; >= 5.3 < 5.3.27; >= 5.4 < 5.4.25.
shodan · alias · wordpress:wordpress
http.html:"wp-content/themes"
open · Banner spelling suggested by the model from the card text (stock WordPress pages reference this path on every rendered page); counted against Shodan before it was shown.
304,622services internet-wide on Shodan · 2026-11-04
Banner spellings: a model read 1 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.
Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-04 12:54Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.
Open questions
- The affected range 4.7.0–7.1.3 and fix 7.1.4 come from pipeline exposure data citing Wordfence and a vendor release note; neither is in S1–S3. Confirm against the primary advisories.
- The hype score cites a public PoC repository; no source reviewed links or describes it.
- Which staging path names are predictable and web-accessible? The sources do not say.
- Does upgrading to the fixed release itself open the race window on a vulnerable site? WordPress has not given guidance in the sources reviewed.
- What is the scope of exploitation (targeted or mass), and are there IoCs?
Sources
- [S1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Cybersecurity and Infrastructure Security Agency (CISA)
- [S2] https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog · CISA
- [S3] https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html · The Hacker News
Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.