{ "schemaVersion": "guard-threat-campaign/v1", "id": "HGTC-2026-1D35694E", "slug": "cve-2026-119977-wordpress-update-hijack-cisa-kev", "title": "WordPress core update hijack now exploited: attackers race the few seconds a site spends updating (CVE-2026-119977, CISA KEV)", "aliases": [ "CVE-2026-119977", "WordPress upgrade window RCE", "WordPress core update race condition", "WordPress 7.1.4 upgrade race CISA KEV", "wp-content/upgrade staged installer" ], "summary": "CVE-2026-119977 is the WordPress core upgrade race fixed in WordPress 7.1.4 on 2026-10-28. During a full-package core update, WordPress 4.7.0 through 7.1.3 staged the new files at a predictable, web-accessible path under wp-content/upgrade/, so an unauthenticated attacker who requested the staged installer during the update window could run code on the server. Wordfence, as CNA, published the CVE on 2026-10-31 with CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N) and CWE-367; WordPress's own advisory GHSA-4w3m-c66w-69mg rates it Low. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-11-03 with a 2026-11-06 due date, forensic triage marked Yes and ransomware use Unknown. Fixed releases exist for every branch back to 4.7 (7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 down to 4.7.39). The update that installed 7.1.4 still ran the old upgrader, so the open question for patched sites is whether an earlier update was raced.", "status": "published", "severity": "high", "confidence": "high", "uncertainty": "CISA does not publish the evidence behind a KEV listing. As of 2026-11-03, CISA, WordPress and Wordfence had not described a specific site that was taken over; Wordfence reported exploitation attempts (more than 18,500 requests for staged installer paths in the first 21 hours after its firewall rule shipped). NVD marked the record Deferred and has not scored it. WordPress rates the issue Low and Wordfence High.", "firstObservedAt": "2026-10-28T17:13:53Z", "lastObservedAt": "2026-11-03T20:58:09Z", "publishedAt": "2026-11-03T21:03:26.913Z", "reviewedAt": "2026-11-03T21:03:22.242Z", "expiresAt": "2026-11-03T20:58:09Z", "reviewer": "HOL Guard Security Publishing", "sources": [ { "id": "cisa-kev", "label": "CISA Known Exploited Vulnerabilities catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "sourceType": "government", "observedAt": "2026-11-03T20:00:24Z" }, { "id": "nvd", "label": "NVD record for CVE-2026-119977", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119977", "sourceType": "vulnerability_database", "observedAt": "2026-10-31T06:16:34Z" }, { "id": "wp-ghsa", "label": "WordPress advisory GHSA-4w3m-c66w-69mg: race condition during core updates", "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg", "sourceType": "maintainer_advisory", "observedAt": "2026-10-29T19:12:01Z" }, { "id": "wp-news", "label": "WordPress 7.1.4 release announcement", "url": "https://wordpress.org/news/2026/10/wordpress-7-1-4/", "sourceType": "vendor_advisory", "observedAt": "2026-10-28T17:13:53Z" }, { "id": "hol-blog", "label": "HOL: WordPress update hijack bug is now on CISA's exploited list", "url": "https://hol.org/blog/cve-2026-119977-wordpress-update-hijack-cisa-kev", "sourceType": "other_primary", "observedAt": "2026-11-03T20:58:09Z" } ], "artifacts": [ { "id": "wordpress-core", "artifactClass": "package", "ecosystem": "other", "name": "WordPress core", "version": "4.7.0 through 7.1.3; fixed in 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 and backports to 4.7.39", "defanged": false } ], "indicators": [], "timeline": [ { "id": "wordpress-714-released", "occurredAt": "2026-10-28T17:13:53Z", "eventType": "vendor_action", "summary": "WordPress releases 7.1.4 with a fix for a race condition during core updates, backported to every branch back to 4.7.", "sourceIds": [ "wp-news" ] }, { "id": "wordpress-advisory-published", "occurredAt": "2026-10-29T19:12:01Z", "eventType": "disclosure", "summary": "WordPress publishes GHSA-4w3m-c66w-69mg, rating the core update race Low severity.", "sourceIds": [ "wp-ghsa" ] }, { "id": "cve-assigned-wordfence", "occurredAt": "2026-10-31T06:16:34Z", "eventType": "disclosure", "summary": "Wordfence publishes CVE-2026-119977 for WordPress 4.7.0 through 7.1.3 with CVSS 3.1 8.1.", "sourceIds": [ "nvd" ] }, { "id": "cisa-kev-added", "occurredAt": "2026-11-03T20:00:24Z", "eventType": "other", "summary": "CISA adds CVE-2026-119977 to the Known Exploited Vulnerabilities catalog with a 2026-11-06 due date and forensic triage required.", "sourceIds": [ "cisa-kev" ] }, { "id": "hol-blog-published", "occurredAt": "2026-11-03T20:58:09Z", "eventType": "other", "summary": "HOL publishes a KEV follow-up with the fix and a check for whether a site's last update was raced.", "sourceIds": [ "hol-blog" ] } ], "coverage": [ { "assertionId": "guard-not-wordpress", "relationship": "not_covered", "limitation": "HOL Guard reviews AI coding agent actions before they run. It does not inspect WordPress servers, the core upgrader or web server configuration; the fix is the WordPress update plus a web server deny rule for wp-content/upgrade/." } ], "policies": [], "limitations": [ "Sites deployed by Composer, git or container images with DISALLOW_FILE_MODS set to true never run the built-in core updater, so there is no upgrade window to race; they still need the fixed code.", "Servers that already denied web access to wp-content/upgrade/ before their last update are not reachable by the race.", "WordPress older than 4.7 is outside the CVE record's affected range.", "The attack only works during a full core update, for a few seconds, with the upgrade folder served over HTTP; a KEV listing does not mean every site that ran the old upgrader was compromised." ], "correctionHref": "/guard/security/campaigns/cve-2026-119977-wordpress-update-hijack-cisa-kev/corrections" }