If you run WordPress, this is a stop-and-update alert. CISA added a high-severity WordPress Core flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming attackers are exploiting it in the wild. Tracked as CVE-2026-119977 (CVSS 8.1), it is a Time-of-check Time-of-use (TOCTOU) race condition that lets an unauthenticated remote attacker execute code on your server during the upgrade window – no login, no account on the site, nothing but a carefully timed request while a core update is running. If your site is internet-facing and not on version 7.1.4, patching today is not optional.
What the vulnerability is. WordPress does full-package core upgrades by staging the new files into predictable, web-accessible directories on the server. CVE-2026-119977 is a race condition in that process: between the check that a staged installer path is safe and the code that actually uses it (the classic time-of-check vs time-of-use gap), an attacker can swap in their own files. Wordfence, which tracked the flaw from the start, confirms exploitation does not require an account on the target site. In layman’s terms, the upgrade window is a moment when the front door is briefly open – and the attacker knows exactly where to look.
Who found it and what version is affected. The flaw was reported by Picus Security researcher Umut Bayram. It affects WordPress versions 4.7 through 7.1.3, which covers the overwhelming majority of WordPress sites on the internet today. The WordPress security team shipped the fix on October 28, 2026 in version 7.1.4 as an emergency security release, explicitly recommending that all sites update immediately.
It is being attacked right now. This is not theoretical. Wordfence recorded more than 18,500 requests targeting the vulnerable staged setup-config.php installer paths within the first 21 hours after disclosure – and is still blocking roughly 13,000 exploit attempts per 24 hours. Threat actors began scanning for this vector almost immediately after the October security release. On November 3, CISA confirmed active exploitation and added CVE-2026-119977 to the KEV catalog, giving federal agencies until November 6 to remediate under Binding Operational Directive 26-04. Everyone else, including private-sector defenders, should treat the patch with the same urgency.
Why it matters so much. WordPress runs a large share of the public web, and this is a zero-credential RCE during routine maintenance. Every site owner who updates plugins, themes, or the core on a schedule has a recurring upgrade window an attacker can target. A successful exploit hands over arbitrary code execution on your web server – the same box that often holds other sites, databases, configuration files, and credentials.
What you need to do right now.
Upgrade to WordPress 7.1.4 immediately. Log in to wp-admin, go to Dashboard > Updates, and run the core update. Confirm WordPress reports version 7.1.4 afterward. If you use managed hosting, update or verify your host has already patched your core.
Do not leave updates sitting. The exploit lives in the upgrade process itself, so postponing updates is exactly what exposes you. If you normally batch core updates, this is the release to do now rather than later.
Check for existing compromise before you trust the patch. Patching closes the hole but does not evict an attacker who is already in. If your site ran a vulnerable version during the disclosure window, review for unexpected files in staging/installer paths, suspicious setup-config.php access in your logs, unexpected admin users, and unfamiliar plugins or themes.
Watch your logs. Keep an eye on access logs for hits to installer and staging paths (setup-config.php, wp-admin/upgrade.php) from unfamiliar IPs. During an upgrade, that traffic is expected from you or your host; outside an upgrade, it is an attempted intrusion.
Keep WordPress updated going forward. Enable automatic background updates for security releases, take regular offline backups, and use a web application firewall or managed WordPress security layer to catch postdisclosure scanning before it reaches your patch level.
The upgrade window on a huge share of the web is now a confirmed, actively exploited RCE vector. Update to WordPress 7.1.4, verify your version, and inspect for signs of prior compromise. A few minutes now beats explaining a webshell on your server later.