Search — “CVE-2026-119977”

Researchers at Picus Security found that the WordPress core update installing fix 7.1.4 unpacks the new installer into wp-content/upgrade using the old, unpatched updater code, so an unauthenticated attacker who predicts the temporary folder name and reaches the installer before deletion can run PHP with web server permissions. Wordfence reported attack attempts starting nine minutes after it deployed a firewall rule, with two sources checking small groups of sites for about 14.5 hours, which it says aligns with attempts to catch site updates. Hunters should look for unexpected requests to PHP files under wp-content/upgrade, unrecognized administrator accounts, unknown plugins, and PHP files in wp-content/upgrade that no one placed there.

CISA's KEV catalog lists CVE-2026-119977, a WordPress Core TOCTOU race condition that could let unauthenticated attackers execute code on the server during full-package core upgrades, exploiting predictable web-accessible staging paths. The KEV entry, dated 2026-11-03 with a due date of 2026-11-06, requires forensic triage under BOD 26-04 and is the basis for the brief's claim of confirmed exploitation. The sources reviewed do not describe specific attacker behavior, payloads, or IoCs, so hunters should focus on web-accessible staging/upgrade directories and unexpected code execution during core updates.