/cards/ once it crosses the publish bar. Status: superseded. Supersedes version 1.WordPress Core CVE-2026-119977 upgrade race condition listed in CISA KEV as exploited
CISA lists CVE-2026-119977, a WordPress Core race condition during full-package core upgrades, as known exploited, with a federal due date of 2026-11-06. Today: inventory WordPress sites, patch to the fixed release, and hunt web logs for requests into upgrade staging paths.
Triage: CISA confirms exploitation of an unauthenticated code-execution flaw in internet-facing WordPress Core, with a 2026-11-06 due date [S1].
CISA KEV, a government primary source, confirms exploitation [S1][S2]. Attacker behaviour, IoCs, the version range and the fixed version are not in S1–S3.
What happened
- CISA added CVE-2026-119977, a WordPress Core TOCTOU race condition, to the KEV catalog on 2026-11-03 [S1][S2].
- The flaw could let unauthenticated attackers execute code on the server during full-package core upgrades, through predictable web-accessible staging paths [S1].
- The KEV entry sets a federal due date of 2026-11-06 and requires forensic triage under BOD 26-04 [S1].
- The sources reviewed do not describe attacker behaviour, payloads or IoCs [S1][S3].
Timeline
| 2026-11-03 | CISA adds CVE-2026-119977 to the KEV catalog. S2 |
| 2026-11-04 | Secondary reporting covers the KEV listing. S3 |
| 2026-11-06 | Federal remediation due date. S1 |
Detect
Web requests into WordPress upgrade staging paths · Web server / reverse proxy / WAF access logs
index=* "/wp-content/upgrade" | rex field=_raw "(?<req_path>/wp-content/upgrade[^\s\"?]*)" | search req_path="*.php*" | stats count earliest(_time) as first_seen latest(_time) as last_seen values(status) as status by host, req_path | convert ctime(first_seen) ctime(last_seen)
A hit means: A client requested a PHP file inside the upgrade staging area, which matches the exploit condition [S1]. This assumes the default WordPress staging directory; the sources do not name the exact path. A 200 response to an external client during an upgrade window warrants forensic triage.
Shell or download tools spawned by the web server or PHP process · EDR / Sysmon / auditd process creation on WordPress hosts
index=* (parent_process_name="php*" OR parent_process_name="httpd" OR parent_process_name="apache2" OR parent_process_name="nginx" OR parent_process_name="w3wp.exe") (process_name="sh" OR process_name="bash" OR process_name="dash" OR process_name="curl" OR process_name="wget" OR process_name="python*" OR process_name="perl" OR process_name="nc" OR process_name="cmd.exe" OR process_name="powershell.exe") | stats count earliest(_time) as first_seen values(process) as cmdline by host, parent_process_name, process_name
A hit means: The web server executed a command, which is consistent with the code execution the KEV entry describes [S1]. Correlate the time with core upgrade windows and with Hunt 1 hits.
Verify
- True positive: an external client fetches or executes a .php file under the upgrade staging path while a core upgrade is running, followed by other activity such as new PHP files, web-server child processes or new admin users.
- Compare hit times with the actual core upgrade times in WordPress or host logs. The race exists only during full-package upgrades [S1].
- Benign look-alike: WordPress itself writes and extracts files in the upgrade directory during legitimate core, plugin and theme updates.
- Benign look-alike: vulnerability scanners and uptime checks probing wp-content paths. These usually return 403 or 404 and show no execution.
- Benign look-alike: legitimate cron, WP-CLI or backup plugins invoking shell or PHP subprocesses.
Scope
Affected
- WordPress Core sites vulnerable to CVE-2026-119977 [S1]. Pipeline exposure data gives 4.7.0 through 7.1.3, citing a Wordfence advisory that is not among S1–S3.
Only if
- A full-package core upgrade is performed, which creates web-accessible staging paths during the upgrade window [S1].
Not affected if
- Core is at a fixed version: 7.1.4 or later per pipeline exposure data, which cites a vendor release note not among S1–S3.
Fixed in: 7.1.4 (per pipeline exposure data; confirm against the WordPress release note)
Enumerate
- All WordPress instances with core version, including marketing, campaign, and third-party or agency-hosted sites.
- Which sites ran a full-package core upgrade since the vulnerable range first applied, and when. Check auto-update logs and hosting-panel history.
- Whether the upgrade/staging directory is reachable over the web on each site.
- Admin accounts, application passwords and API keys on each site.
- Credentials and secrets stored on WordPress hosts, such as wp-config.php database credentials and cloud keys.
Contain
- Preserve evidence first: export web access logs and snapshot the wp-content/upgrade directory and the web root before any cleanup. Deleting staging contents cannot be undone.
- Patch to the fixed release. Because the race occurs during upgrades [S1], run the upgrade with the site restricted (maintenance mode, IP allowlist or WAF deny on staging paths) if feasible. This precaution is derived from the described mechanism; it is not vendor guidance.
- Until patched, avoid unattended full-package core upgrades on internet-exposed sites, or block web access to the staging directory.
- Isolate any site with a confirmed Hunt 1 or Hunt 2 hit from internal networks and databases pending forensic triage, as BOD 26-04 requires for federal agencies [S1].
Eradicate
- The sources describe no specific persistence. On a confirmed hit, remove unknown PHP files, web shells, rogue admin users and application passwords, then reinstall core from a clean package.
- Rotate database credentials, salts and keys in wp-config.php and any secrets on the host.
Recover
- Before restoring traffic, confirm the core version is fixed, checksums match, and no unknown PHP files or admin accounts remain.
- Monitor web logs for staging-path requests and web-server child processes for at least the next upgrade cycle.
- Watch outbound connections from WordPress hosts for unexpected destinations.
Re-enter the loop when
- A vendor or CERT publishes IoCs, staging paths or exploit timing.
- WordPress or CISA changes the affected or fixed version range.
- Public exploit code is confirmed, or exploitation spreads to mass scanning.
- Any hunt hit appears on a site outside the original inventory.
Debrief
- Record each WordPress site with its version, upgrade times and hunt results.
- Record the time from KEV listing (2026-11-03) to patch for each site.
- Gap: no source reviewed gives the exact staging path, exploit timing or IoCs.
- Gap: the version range and fixed version come from advisories not among S1–S3.
- Gap: whether the inventory covered third-party or agency-hosted sites.
Detection coverage — checked automatically
| Category | Source | Status |
|---|---|---|
| Vendor | Impacted vendor / CERT advisory | published — primary source among the thread's sources: https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| Government | CISA KEV · CVE-2026-119977 | published — listed 2026-11-03, federal due 2026-11-06 |
| Reference | NVD · CVE-2026-119977 | published — published 2026-10-31, CVSS 3.1 8.1 |
| VM scanners | Qualys · CVE-2026-119977 | published — ThreatPROTECT: CISA Warns of WordPress Vulnerability Exploited in the Wild (CVE-2026-119977) |
| VM scanners | Rapid7 · CVE-2026-119977 | nothing found — entry exists, no InsightVM coverage stated |
| VM scanners | Tenable · CVE-2026-119977 | nothing found — no plugin names the CVE yet |
| EDR / endpoint VM | CrowdStrike blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | Microsoft Security blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | SentinelOne blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | SentinelOne Labs | nothing found — no post names it among the feed's 10 newest items |
| WAF / edge | Akamai blog | nothing found — no post names it among the feed's 1181 newest items |
| WAF / edge | Cloudflare WAF managed-ruleset changelog | nothing found — no post names it among the feed's 137 newest items |
| Cloud / container | Wiz blog | nothing found — no post names it among the feed's 716 newest items |
| Linux distro errata | Debian tracker · CVE-2026-119977 | published — tracker entry |
| Linux distro errata | Red Hat · CVE-2026-119977 | nothing found — entry exists, no errata yet |
| IDS / research | Cisco Talos blog | nothing found — no post names it among the feed's 15 newest items |
| IDS / research | Emerging Threats open · CVE-2026-119977 | nothing found — no open rule names it (exploit, web_server, web_specific_apps sets) |
| Detection content | Elastic detection rules | published — 3 files name WordPress: rules/linux/persistence_webserver_php_file_creation_in_wordpress_plugin_dir.toml, rules/_deprecated/defense_evasion_code_injection_conhost.toml, rules/macos/privilege_escalation_user_added_to_admin_group.toml |
| Detection content | Elastic Security Labs | nothing found — no post names it among the feed's 103 newest items |
| Detection content | SigmaHQ rules | published — 17 files name WordPress: deprecated/windows/win_susp_vssadmin_ntds_activity.yml, deprecated/windows/proc_creation_win_susp_squirrel_lolbin.yml, rules/windows/file/file_event/file_event_win_iso_file_mount.yml, rules/web/proxy_generic/proxy_ua_frameworks.yml |
| Detection content | Splunk ESCU | published — 12 files name WordPress / TOCTOU: stories/wordpress_vulnerabilities.yml, detections/web/wordpress_bricks_builder_plugin_rce.yml, stories/xworm.yml, stories/clop_ransomware.yml |
| Community | Nuclei template · CVE-2026-119977 | nothing found — no template under http/cves |
| MSSP / IR firms | Arctic Wolf blog | nothing found — no post names it among the feed's 10 newest items |
| MSSP / IR firms | Huntress blog | nothing found — no post names it among the feed's 748 newest items |
| MSSP / IR firms | Rapid7 blog | nothing found — no post names it among the feed's 20 newest items |
| MSSP / IR firms | Sophos threat research | nothing found — no post names it among the feed's 15 newest items |
| Research | Unit 42 | nothing found — no post names it among the feed's 15 newest items |
Checked automatically 2026-11-04 13:07Z from public sources: 8 published, 19 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.
What a person would still look up (4)
| VM scanners | Look up whether your scanner has a check naming CVE-2026-119977 and whether it reads the core version. |
| WAF / edge | Check vendor changelogs for rules covering WordPress upgrade staging paths. |
| EDR | Confirm process-creation telemetry is collected from WordPress hosts, including PHP-FPM children. |
| Detection content | Check Sigma, Splunk ESCU and Elastic repositories for content naming this CVE. |
Exposure queries — generated automatically
shodan · cve · CVE-2026-119977
vuln:CVE-2026-119977
open · Shodan tags a service with a CVE from its banner version; a paid-tier filter. Exact for this CVE, blind to a host Shodan has not fingerprinted.
0match this spelling on Shodan · 2026-11-04 — Shodan has tagged no banner with this CVE yet; its tagging follows its own version fingerprinting, not the advisory
shodan · cpe · wordpress:wordpress
cpe:"cpe:/a:wordpress:wordpress"
open · Every Wordpress service Shodan fingerprinted, any version (CPE 2.2 form of cpe:2.3:a:wordpress:wordpress). Affected per NVD: >= 4.7 < 4.7.39; >= 4.8 < 4.8.34; >= 4.9 < 4.9.35; >= 5.0 < 5.0.31; >= 5.1 < 5.1.28; >= 5.2 < 5.2.30; >= 5.3 < 5.3.27; >= 5.4 < 5.4.25.
2,278,704services internet-wide on Shodan · 2026-11-04
shodan · product · wordpress:wordpress
product:"Wordpress"
open · Banner product name, NVD's spelling; adjust if Shodan's differs. Affected per NVD: >= 4.7 < 4.7.39; >= 4.8 < 4.8.34; >= 4.9 < 4.9.35; >= 5.0 < 5.0.31; >= 5.1 < 5.1.28; >= 5.2 < 5.2.30; >= 5.3 < 5.3.27; >= 5.4 < 5.4.25.
0match this spelling on Shodan · 2026-11-04
censys · product · wordpress:wordpress
host.services: (software.product = "Wordpress")
Censys Platform host search, software as fingerprinted at layer 7. Affected per NVD: >= 4.7 < 4.7.39; >= 4.8 < 4.8.34; >= 4.9 < 4.9.35; >= 5.0 < 5.0.31; >= 5.1 < 5.1.28; >= 5.2 < 5.2.30; >= 5.3 < 5.3.27; >= 5.4 < 5.4.25.
shodan · alias · wordpress:wordpress
http.html:"wp-includes/js/wp-emoji-release.min.js"
open · Banner spelling suggested by the model from the card text (core script path present on nearly every WordPress front end); counted against Shodan before it was shown.
207,444services internet-wide on Shodan · 2026-11-04
Banner spellings: a model read 1 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest were dropped.
Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-04 13:07Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.
Open questions
- What is the exact staging path and race window? The sources do not say.
- Is the 4.7.0–7.1.3 range and the 7.1.4 fix confirmed by WordPress.org?
- The context notes a public PoC repo, but no source among S1–S3 confirms it.
- Who exploited this, and what payloads were used? Not stated.
Sources
- [S1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Cybersecurity and Infrastructure Security Agency (CISA)
- [S2] https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog · CISA
- [S3] https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html · The Hacker News
Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.