Blog

Urgent: WordPress core flaw CVE-2026-119977 is being exploited

By DBshieldX research · 9 November 2026

A serious flaw in WordPress core is being exploited now, and it is listed as known exploited by CISA. It lets an unauthenticated visitor run code on the server during a core upgrade. If you run WordPress, update today and read the cautions below before you do.

What happened

The flaw is tracked as CVE-2026-119977. The National Vulnerability Database entry describes a race condition in WordPress core that arises during full core upgrades. The cause is that the staging paths used in the upgrade are predictable and reachable from the web. CISA lists it as known exploited.

Wordfence reports that attackers are actively probing sites for it. It affects WordPress versions 4.7 through 7.1.3. A successful attack can lead to full takeover of the site.

There is a catch with the fix. The Hacker News reports that the update process still unpacks files using the old, vulnerable code. A well-timed attacker can therefore still get code running while you install the patch. The researcher’s advice is to block web access to the update path while you update.

Does it affect you

You are likely affected if:

• Your site runs WordPress core at any version from 4.7 to 7.1.3.
• Your site is public and can be reached by anyone on the internet.

The risk is highest while a core upgrade is in progress. That includes automatic background updates, so do not assume you are safe because you never click the update button. Sites on older branches should look for the backported security release for their branch, which the sources mention alongside 7.1.4.

If you manage sites for clients, treat every WordPress install you look after as in scope until you have checked its version.

What to do now

1. Check your version. Look in the WordPress dashboard or ask your host. If it is 7.1.3 or older, go to step 2.
2. Restrict web access to the upgrade and staging paths first. Use your web server or host configuration to deny public requests to those locations for the duration of the update. Follow your host’s guidance or the linked advisories for the exact paths on your setup.
3. Apply the fixed release. Update to 7.1.4, or the backported security release for your branch. Pick a quiet period when traffic is low, and avoid leaving the update half-finished.
4. Check for unexpected files afterwards. Look in the upgrade and staging directories, and in the main WordPress folders, for files you do not recognise or that were changed at odd times. Compare core files against a clean copy if you can.
5. Review your logs. Search for requests to upgrade or staging paths from the past week or so, especially from addresses that made many requests in a short time. Repeated hits suggest probing.
6. If you find anything suspicious, act at once. Take the site offline or into maintenance mode, restore from a known clean backup, and change all admin, database and hosting passwords and keys.
7. Add monitoring as a second layer. A web application firewall such as DBshieldX has rules for scanners and probes for exposed files, and can run in monitor mode first so you see what it would flag. It is rules-based and does not catch everything, so it supports patching rather than replacing it.

The most important step is to patch quickly while keeping the update path closed to the public. Doing both together closes the window the attackers are looking for.