WordPress CVE-2026-119977: the patch update itself is exposed

The update that fixes the hole runs through the hole. WordPress CVE-2026-119977 is a race condition in the core update process, and CISA lists it as exploited. The fix shipped in WordPress 7.1.4 on October 28. On November 6, The Hacker News reported the catch: on many sites, the update that installs the fix still uses the old, unpatched updater. That opens the window one last time. Auto-updates don't skip it.

What actually happened

• The flaw. During a full-package core update, WordPress unpacks the new version into a temporary folder under wp-content/upgrade. That copy includes the installer, and the web server can usually reach it. CISA's KEV entry says an unauthenticated attacker can run code on the server during that upgrade window, because the staging paths are predictable.
• Who's affected. WordPress 4.7 through 7.1.3. WordPress.org says it is backporting fixes to every branch back to 4.7, and those backports ship as they become ready.
• Severity, two ways. Wordfence scores it 8.1. WordPress's own advisory rates it low. The window lasts only seconds in Wordfence's lab tests.
• Exploitation. CISA added it to the KEV catalog on November 3, with a November 6 deadline for federal agencies. SecurityWeek reports that Wordfence logged more than 18,500 requests at staged installer paths in its first 21 hours. Attackers poll sites again and again to catch the moment an update starts. Wordfence hasn't reported a confirmed compromise.
• The last exposure. Per researcher Umut Bayram, quoted by The Hacker News: sites on 5.9 or later name the temporary folder after the download file. So the name is predictable during the fixing update. The wp-config.php overwrite is already blocked at that point. But an attacker who wins the race can still stand up the temporary copy and run PHP as the web server.

Why it matters for your business

Most small business sites update on autopilot. Usually, that's the right call. Here, the routine is the exposure, and wp core update in WP-CLI doesn't help because it uses the same updater.

Do it in this order:

1. Block the folder first. Deny web access to /wp-content/upgrade/. On Nginx: location ^~ /wp-content/upgrade/ { deny all; }. With only .htaccess, put RedirectMatch 403 ^/wp-content/upgrade/ in the root .htaccess, above the WordPress rules. Don't put an .htaccess inside the folder, because the old updater deletes it.
2. Confirm the block. Request /wp-content/upgrade/ and expect a 403.
3. Then update to 7.1.4 or your branch's fixed release.
4. Check for a break-in if you ran 7.1.3 or earlier after October 28. Look for PHP files in wp-content/upgrade, unknown admin accounts, plugins nobody installed, and requests to PHP files under that folder in your logs.

Sources: WordPress.org, The Hacker News, CISA KEV, SecurityWeek.