WordPress 7.1.4 upgrade-window RCE is now on CISA's exploited list
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
CISA added CVE-2026-119977, a race condition in WordPress core's upgrade process, to its Known Exploited Vulnerabilities catalog on November 3, recording active exploitation. While an update unpacks, a guessable copy of WordPress in wp-content/upgrade/ can let an unauthenticated attacker run code. Rated CVSS 8.1 with high attack complexity, it affects branches 4.7 through 7.1 and is fixed in 7.1.4 and backports. Patchstack advises blocking that directory at the web server, since PHP firewall plugins don't load there. Attack scale is unreported, and the dates and score were not independently verified.