Is the campaign still active?

No. Active tracking ended Nov 3, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

What evidence supports this record?

The record cites 5 primary sources, names 1 reviewed artifact, and was last fully reviewed Nov 3, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

How can this record be cited or exported?

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. CISA does not publish the evidence behind a KEV listing.

high severityConfidence highHistorical record

WordPress core update hijack now exploited: attackers race the few seconds a site spends updating (CVE-2026-119977, CISA KEV)

Direct answer

WordPress core update hijack now exploited: attackers race the few seconds a site spends updating (CVE-2026-119977, CISA KEV), also tracked as CVE-2026-119977 / WordPress upgrade window RCE / WordPress core update race condition is a high-severity threat campaign HOL Guard tracked from Oct 28, 2026 to Nov 3, 2026, verified against 5 primary sources and last reviewed Nov 3, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-119977 is the WordPress core upgrade race fixed in WordPress 7.1.4 on 2026-10-28. During a full-package core update, WordPress 4.7.0 through 7.1.3 staged the new files at a predictable, web-accessible path under wp-content/upgrade/, so an unauthenticated attacker who requested the staged installer during the update window could run code on the server. Wordfence, as CNA, published the CVE on 2026-10-31 with CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N) and CWE-367; WordPress's own advisory GHSA-4w3m-c66w-69mg rates it Low. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-11-03 with a 2026-11-06 due date, forensic triage marked Yes and ransomware use Unknown. Fixed releases exist for every branch back to 4.7 (7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 down to 4.7.39). The update that installed 7.1.4 still ran the old upgrader, so the open question for patched sites is whether an earlier update was raced.

Also tracked as CVE-2026-119977 · WordPress upgrade window RCE · WordPress core update race condition · WordPress 7.1.4 upgrade race CISA KEV · wp-content/upgrade staged installer

First observed: Oct 28, 2026
Last observed: Nov 3, 2026
Last reviewed: Nov 3, 2026
Tracking ended: Nov 3, 2026

Record exports

JSON record Artifact CSV STIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

CISA does not publish the evidence behind a KEV listing. As of 2026-11-03, CISA, WordPress and Wordfence had not described a specific site that was taken over; Wordfence reported exploitation attempts (more than 18,500 requests for staged installer paths in the first 21 hours after its firewall rule shipped). NVD marked the record Deferred and has not scored it. WordPress rates the issue Low and Wordfence High.

Sites deployed by Composer, git or container images with DISALLOW_FILE_MODS set to true never run the built-in core updater, so there is no upgrade window to race; they still need the fixed code.
Servers that already denied web access to wp-content/upgrade/ before their last update are not reachable by the race.
WordPress older than 4.7 is outside the CVE record's affected range.
The attack only works during a full core update, for a few seconds, with the upgrade folder served over HTTP; a KEV listing does not mean every site that ran the old upgrader was compromised.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

not covered
HOL Guard reviews AI coding agent actions before they run. It does not inspect WordPress servers, the core upgrader or web server configuration; the fix is the WordPress update plus a web server deny rule for wp-content/upgrade/.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controls Campaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

Oct 28, 2026Vendor action
WordPress releases 7.1.4 with a fix for a race condition during core updates, backported to every branch back to 4.7.
Source:WordPress 7.1.4 release announcement
Oct 29, 2026Disclosure
WordPress publishes GHSA-4w3m-c66w-69mg, rating the core update race Low severity.
Source:WordPress advisory GHSA-4w3m-c66w-69mg: race condition during core updates
Oct 31, 2026Disclosure
Wordfence publishes CVE-2026-119977 for WordPress 4.7.0 through 7.1.3 with CVSS 3.1 8.1.
Source:NVD record for CVE-2026-119977
Nov 3, 2026Update
CISA adds CVE-2026-119977 to the Known Exploited Vulnerabilities catalog with a 2026-11-06 due date and forensic triage required.
Source:CISA Known Exploited Vulnerabilities catalog
Nov 3, 2026Update
HOL publishes a KEV follow-up with the fix and a check for whether a site's last update was raced.
Source:HOL: WordPress update hijack bug is now on CISA's exploited list

Publication clock: 121.9 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

WordPress core@4.7.0 through 7.1.3; fixed in 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 and backports to 4.7.39otherpackage

Sources

Every claim on this record is traceable to the sources below.

Related reviewed records

Records this one was reviewed against. Every relationship below is part of a released revision, with the reviewer’s stated reason.

Related records

WordPress 7.1.4: a race in the core upgrade process let an unauthenticated visitor reach the unpacked installer mid-update (plus 21 account-required fixes)Related advisorySame WordPress core upgrade race, covered at the 7.1.4 release before CVE-2026-119977 was assigned and before the CISA KEV listing.

Campaign questions, answered

Reviewed in full by HOL Guard Security Publishing.

Published: November 3, 2026
Last full review: November 3, 2026
Last modified: November 3, 2026

Report a correction

Record HGTC-2026-1D35694E