Critical WordPress Update Flaw Exposes Millions of Websites to Remote Code Execution During the Patching Process

The global cybersecurity community has turned its attention to a complex and counterintuitive vulnerability within the world’s most popular Content Management System (CMS), highlighting the inherent risks involved in applying security patches. Tracked as CVE-2026-119977 and carrying a critical CVSS severity score of 8.1 out of 10, the flaw affects WordPress versions 4.7 through 7.1.3. Ironically, the vulnerability can be weaponized precisely while administrators attempt to secure their servers by installing the very update designed to mitigate the underlying security risk.

Discovered and detailed by Umut Bayram, a security researcher at Picus Security, the exploit vector exposes a fundamental flaw in how older core update routines handle temporary files. Because the update installation process relies on the site’s legacy, unpatched codebase to unpack incoming files, malicious actors who time their attacks with surgical precision can hijack the installation window. This allows them to execute arbitrary code with the permissions of the underlying web server, fundamentally compromising the integrity of the host server before the core upgrade can fully complete.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recognized the severity of the threat by adding CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. Concurrently, security telemetry from firms like Wordfence revealed aggressive scanning and exploitation attempts occurring mere minutes after defensive signatures and firewall rules were deployed to the public. The discovery has prompted renewed scrutiny into how software supply chains and automated patch management systems handle transition states during core framework updates.

Understanding the Mechanics of CVE-2026-119977

To comprehend the mechanics of this vulnerability, one must examine how WordPress traditionally processes core software updates. When a site initiates a complete core package update, the CMS downloads a compressed archive and unpacks it into a temporary staging directory typically located within the wp-content/upgrade folder. Crucially, this temporary folder houses a fully functional copy of the WordPress installer, and under standard configurations, web servers can resolve and access files within this directory.

Prior to the issuance of the fix, an unauthenticated attacker could theoretically determine or predict the name of this temporary folder, access the installer interface, and upload a malicious configuration file—specifically a crafted wp-config.php—into the staging directory. When the automated update finalized, the system would inadvertently overwrite the legitimate production configuration file with the malicious variant, granting the attacker administrative control or Remote Code Execution (RCE) capabilities.

The core vulnerability highlighted by Bayram lies in a transition paradox: while WordPress 7.1.4 and its companion patches introduce robust remediations—such as assigning randomized names to temporary staging directories and preventing configuration file overwrites—the code responsible for executing the update itself is legacy code. On sites running WordPress versions 5.9 through 7.1.3, the updater script extracts the new files using vulnerable legacy functions. Because the legacy code relies on predictable naming conventions tied to the downloaded package name during specific update paths, attackers monitoring high-traffic sites or scanning broad IP ranges can forecast the exact deployment window.

By timing requests to coincide precisely with the seconds-long installation window, malicious actors can interface with the staging directory’s temporary WordPress installation. If successful, they can establish a temporary database connection, authenticate into the staging instance, and execute arbitrary PHP code under the privileges of the web server user. This grants them the ability to read, modify, or inject malicious payloads into the live production environment before the temporary upgrade directory is automatically purged by the system.

Chronology of Discovery, Disclosure, and Active Exploitation

The timeline surrounding CVE-2026-119977 illustrates the lightning-fast operational tempo of modern cyber threat actors relative to responsible disclosure and patch management cycles.

The sequence of events unfolded rapidly across October and November:

• Mid-October 2026: Security researchers and automated threat intelligence platforms begin noticing anomalous, highly targeted requests directed at WordPress installation paths, immediately following the initial internal identification of the update-phase flaw.
• Release Day (Late October 2026): WordPress officially publishes version 7.1.4 alongside backported security fixes for older supported branches (dating back to version 4.7) via its official GitHub repository and security advisories. Concurrently, security vendors such as Wordfence deploy specialized firewall rules and web application firewall (WAF) signatures to shield clients.
• Nine Minutes Post-Release: Demonstrating the rapid operational capabilities of modern opportunistic threat groups, Wordfence telemetry records the first active exploitation attempts targeting the vulnerability, occurring a mere nine minutes after firewall rules went live.
• 14.5-Hour Scanning Campaign: Two primary, high-volume threat actor infrastructures maintain continuous, systematic scanning operations across broad groups of web servers for approximately 14.5 hours—a duration security analysts attribute directly to attempts to catch the transient update window of unsuspecting site administrators.
• Early November 2026: CISA officially adds CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, mandating federal civilian agencies to secure their systems within strict timeframes. Proof-of-concept (PoC) exploit scripts begin appearing in public GitHub repositories, prompting urgent warnings across the web hosting and cybersecurity sectors.
• November 6, 2026: Picus Security researcher Umut Bayram provides formal technical clarifications to industry media regarding the nuanced differences between complete packages, partial packages, and the underlying state of the pre-existing local updater code.

Differentiating Exposure Levels: Complete vs. Partial Packages

A vital nuance emphasized by security researchers is that not every WordPress update carries an identical level of risk. The exposure window is strictly tethered to the nature of the update package deployed and the operational state of the local server environment.

Complete update packages—typically deployed when jumping across major version branches (such as upgrading from version 7.0.7 to 7.1.4) or when performing a manual re-installation—invariably bundle the installer files necessary to trigger the vulnerability. Conversely, partial update packages (often delivered for minor updates within the same branch, such as 7.1.3 to 7.1.4) contain only the binary diffs and specific files modified between two consecutive releases. If a partial package omits the core installer files, the temporary staging directory cannot initialize as a functional WordPress instance, rendering the exploit vector inert.

However, administrators cannot rely entirely on partial updates for safety. WordPress’s native update engine automatically falls back to downloading a complete package if it detects discrepancies in core file checksums, if custom modifications exist within the core file tree, or if the update process is forced as a manual re-installation. Consequently, thousands of sites undergoing standard maintenance or automatic background updates remain susceptible if their pre-update codebase lacks the necessary hardening.

Furthermore, sites operating on legacy branches between 4.4 and 5.8 benefit from an older codebase behavior that appends random characters to temporary upgrade folder names. While this obfuscates the directory path, it does not provide absolute immunity, as predictable folder naming re-emerged in subsequent architectural iterations prior to the release of version 7.1.4. Sites running WordPress version 4.6 and earlier—which reached end-of-life status long ago and no longer receive official security patches—remain permanently exposed unless migrated to a modern, supported software branch.

Official Industry Responses and Expert Analysis

The disclosure of CVE-2026-119977 has ignited substantial debate within the content management and developer communities regarding patch deployment methodologies. While WordPress’s official security advisory rated the vulnerability with a relatively low severity classification—attributable to the narrow, highly transient window of opportunity required to successfully execute the attack—independent security institutions strongly disagree with this downplaying.

Wordfence assigned an 8.1 (High) CVSS rating to the record, pointing out that in automated laboratory simulations and real-world telemetry, even a multi-second execution window is more than sufficient for scripted botnets to achieve complete server compromise. The discrepancy between vendor advisories and third-party risk scoring underscores the evolving philosophy of supply chain security: vulnerabilities that manifest during the remediation phase represent an especially insidious class of threat, effectively weaponizing administrative best practices against the site owner.

Security analysts have also cautioned against placing blind faith in automated command-line utilities. Specifically, popular administrative tools like WP-CLI—which many sysadmins utilize to execute batch updates via commands such as wp core update—do not circumvent the underlying risk. Because WP-CLI invokes the native core upgrader class, it unpacks update packages into the exact same vulnerable temporary directories within the web root, exposing the server to identical timing attacks.

Mitigation Strategies and Recommended Best Practices

Given the active exploitation campaigns documented by CISA and commercial security vendors, web administrators managing self-hosted WordPress installations are urged to implement immediate defensive measures, particularly when orchestrating upgrades to version 7.1.4 or later.

Security researchers recommend two primary operational pathways to neutralize the vulnerability during the patching process:

1. Restricting Web Access to the Upgrade Directory:
   Prior to initiating any core software update, administrators should configure their web server (such as Apache or Nginx) to explicitly block external HTTP/HTTPS access to the wp-content/upgrade directory. Because WordPress accesses this folder directly at the file-system level via local disk I/O operations, blocking incoming web traffic to this specific path does not impede the update engine’s functionality, yet it entirely forecloses an external attacker’s ability to reach the temporary installer interface.

2. Executing Out-of-Root Manual Upgrades:
   For high-security environments or enterprise deployments, administrators should bypass the native dashboard updater entirely in favor of an out-of-root manual installation procedure. This involves taking comprehensive offline backups of both the site database and file system, extracting the new WordPress release archive within a directory strictly outside the web server’s document root, and carefully copying core application files into the production environment. Crucially, administrators must ensure that existing wp-config.php files and the wp-content directory remain untouched during the file transfer, followed by running the standard database upgrade routine. This methodology ensures that no temporary installer scripts are ever instantiated within a web-accessible directory.

For sites that may have remained vulnerable during the recent update cycle, forensic specialists recommend auditing server access logs for anomalous POST requests directed at temporary upgrade paths, checking for unauthorized modifications to database privilege tables, and scanning the file system for newly generated PHP web shells or unfamiliar administrative user accounts. As the digital landscape continues to grow more adversarial, the incident surrounding CVE-2026-119977 serves as a stark reminder that the process of securing software infrastructure requires just as much vigilance as the running software itself.