WordPress Core RCE exploited in the wild (CVE-2026-119977)

Actively exploited in the wild - CVE-2026-119977 is a high-severity remote code execution vulnerability in WordPress Core versions 4.7 through 7.1.3 that grants unauthenticated attackers code execution on the server during the core upgrade window. Update WordPress Core past 7.1.3 and restrict access to upgrade staging paths until patched.

Overview

WordPress Core versions 4.7 through 7.1.3 expose predictable, web-accessible staging paths while performing full-package core upgrades. During an upgrade, WordPress writes package files to a temporary location inside the web root before moving them into place. Because those paths follow a guessable pattern, an attacker who can reach the site can request or plant files at those locations while the upgrade is running. That gives an unauthenticated attacker a way to get code executed by the web server.

The attack requires the site to be mid-upgrade and the attacker to time requests correctly, which is why the CVSS vector lists high attack complexity. But no credentials and no user interaction are needed, and CISA has confirmed this vulnerability is actively exploited in the wild. Real-world exploitation of this class of bug is not theoretical: attackers have repeatedly abused WordPress upgrade and update paths to drop web shells that persist long after the upgrade finishes.

Impact

A successful attacker executes arbitrary code as the web server user. That typically means:

• Reading wp-config.php and harvesting database credentials
• Dropping persistent web shells that survive core updates
• Pivoting to the database or neighboring hosts on the same server
• Defacing the site or injecting malicious content and redirects for visitors

Sites that allow unattended core updates, or that run upgrades on a predictable schedule, are the easiest targets because the window is publicly knowable.

Remediation and mitigation

1. Update WordPress Core. Move to a release after 7.1.3 as soon as the vendor publishes it. This is the only complete fix.
2. Do not run upgrades on a fixed public schedule. Trigger core upgrades manually, and avoid leaving a site in the “updating” state for extended periods.
3. Block staging paths at the edge. Use your web server or WAF to deny direct requests to update and upgrade temporary directories. Blocking direct requests to wp-content/upgrade and .tmp-style paths is a strong interim control.
4. Audit after every upgrade. Scan for unexpected PHP files in the web root, wp-content/uploads, and upgrade directories, and check file modification times against your last known-good baseline.
5. Harden the server. Disable file editing via DISALLOW_FILE_EDIT, run PHP with open_basedir where practical, and keep the web server user’s write permissions to a minimum.

If you suspect a site was compromised during an upgrade window, treat it as a full incident: rotate database credentials and WordPress salts, review logs for requests to staging paths, and check our breach reports and security news for related activity.

Security Insight

WordPress has spent years convincing administrators that core updates are safe and routine, and this bug is a reminder that the update machinery itself is attack surface. The predictability of staging paths is a design choice inherited from an era when shared hosting and FTP-based upgrades were the norm; it should have been retired alongside them. For defenders, the lesson generalizes beyond WordPress: any product that writes executable files into the web root during maintenance needs those paths randomized or blocked at the perimeter, because attackers watch update cycles the same way they watch patch Tuesdays.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs