WordPress update race flaw CVE-2026-119977 is now being exploited

WordPress update race flaw CVE-2026-119977 is now being exploited

4 November 2026: Attackers are exploiting CVE-2026-119977, the race condition in WordPress core updates that WordPress fixed in version 7.1.4, according to alerts from Italy's national cybersecurity agency, ACN, and the Dutch National Cyber Security Centre. Every WordPress branch from 4.7 to 7.1.3 is affected, and the fix has been backported to each of them.

Not yet independently verified. Neither agency says who is attacking or how many sites are affected, and the Dutch NCSC rates the likelihood of abuse "low" on the same page that says exploitation is known. We will update this when it can be confirmed, and remove this note.

How the update window is attacked

ACN describes the flaw, rated CVSS 8.1, as a time-of-check to time-of-use race. During a full core update, WordPress unpacks the new release into a staging directory whose path is predictable and reachable from the web. An unauthenticated attacker who knows when an update is running can call files in that directory before the update completes and run arbitrary code on the server.

That makes the moment of updating itself the risk, which is unusual: a site that updates late is exposed for as long as it stays on an old version, but even a site updating promptly to an affected build passes through the window.

The fixed builds by branch

ACN lists the versions that close the hole:

• 7.1.4 and 7.0.8;
• 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16 and 6.0.18;
• 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28 and 5.0.31;
• 4.9.35, 4.8.34 and 4.7.39.

We reported the release itself when it shipped; our earlier item has the rest of the 7.1.4 fixes.

What site owners should check now

Most sites receive minor core releases automatically, but not all: hosts, agencies and managed platforms sometimes switch automatic updates off, and sites pinned to an old branch only get the backport if the branch's automatic updates are on. Owners should:

• confirm the exact version in the dashboard or with wp core version against the list above;
• look for unexpected PHP files left in the upgrade or staging folders under wp-content, and for new admin users, if an update ran on an affected build after the flaw became known;
• for fleets, check the version across every site rather than trusting the update setting, since the race is exploited during the update itself.

Related on TrustList:

• Adobe fixes CVSS 10 flaws in ColdFusion and Experience Manager
• Drupal Commerce access bypass is exploited; update to 3.3.13

Sources

• ACN (CSIRT Italia) alert AL12/261104: WordPress, exploitation of CVE-2026-119977 detected (Italian), 4 November 2026
• NCSC (Netherlands): vulnerability in WordPress core with active abuse (Dutch), 4 November 2026