{"type":"bundle","id":"bundle--1bf745a3-6f49-5906-b630-fa422245ad13","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--8d188f0e-12f4-5c5e-81fb-6d3e52f9a9a9","created":"2026-11-03T21:03:26.913Z","modified":"2026-11-03T21:03:26.913Z","name":"WordPress core update hijack now exploited: attackers race the few seconds a site spends updating (CVE-2026-119977, CISA KEV)","description":"CVE-2026-119977 is the WordPress core upgrade race fixed in WordPress 7.1.4 on 2026-10-28. During a full-package core update, WordPress 4.7.0 through 7.1.3 staged the new files at a predictable, web-accessible path under wp-content/upgrade/, so an unauthenticated attacker who requested the staged installer during the update window could run code on the server. Wordfence, as CNA, published the CVE on 2026-10-31 with CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N) and CWE-367; WordPress's own advisory GHSA-4w3m-c66w-69mg rates it Low. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-11-03 with a 2026-11-06 due date, forensic triage marked Yes and ransomware use Unknown. Fixed releases exist for every branch back to 4.7 (7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 down to 4.7.39). The update that installed 7.1.4 still ran the old upgrader, so the open question for patched sites is whether an earlier update was raced.","aliases":["CVE-2026-119977","WordPress upgrade window RCE","WordPress core update race condition","WordPress 7.1.4 upgrade race CISA KEV","wp-content/upgrade staged installer"],"first_seen":"2026-10-28T17:13:53Z","last_seen":"2026-11-03T20:58:09Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"source_name":"NVD record for CVE-2026-119977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977"},{"source_name":"WordPress advisory GHSA-4w3m-c66w-69mg: race condition during core updates","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg"},{"source_name":"WordPress 7.1.4 release announcement","url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/"},{"source_name":"HOL: WordPress update hijack bug is now on CISA's exploited list","url":"https://hol.org/blog/cve-2026-119977-wordpress-update-hijack-cisa-kev"}]}]}