{"slug":"wordpress-core-upgrade-window-rce","title":"WordPress Core upgrade-window RCE (CVE-2026-119977)","shortName":"WordPress Core","summary":"Unauthenticated remote code execution in WordPress Core during a full-package core update. Affected versions unpacked the new files into a predictable, web-served folder under /wp-content/upgrade/. An attacker who reaches the staged installer in that seconds-long window can run PHP as the web-server user. Fixed 28 Oct 2026 in 7.1.4 and backports through 4.7.39. Wordfence scored CVSS 3.1 8.1 High (AC:H). CISA listed CVE-2026-119977 in KEV on 3 Nov 2026 (catalog 2026.11.03, due 6 Nov 2026; ransomware use Unknown; forensic triage required). CISA has not described the activity it observed. Wordfence said (28-29 Oct 2026) threat actors were actively attempting to exploit it: more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours. As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence. Patchstack would not call the seconds-long race practical to exploit. No public PoC indexed.","isExample":false,"draft":false,"family":"wordpress-core-upgrade-window-rce","kind":"single-product","aliases":["CVE-2026-119977","GHSA-4w3m-c66w-69mg","WordPress upgrade-window RCE","WordPress staged-installer RCE"],"publishedAt":"2026-11-03","updatedAt":"2026-11-03","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-119977","cvss":{"cve":"CVE-2026-119977","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977","sourceDate":"2026-10-31","checkedDate":"2026-11-03","dateLabel":"CNA record dated","sourceLabel":"NVD record (Wordfence CNA)","nvdPublishedDate":"2026-10-31"},"epss":{"cve":"CVE-2026-119977","score":0.006,"percentile":0.48751,"date":"2026-11-03","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-119977","checkedDate":"2026-11-03"},"kev":{"cve":"CVE-2026-119977","listed":true,"dateAdded":"2026-11-03","dueDate":"2026-11-06","catalogVersion":"2026.11.03","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-03"},"addedDate":"2026-11-03"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated remote code execution in WordPress Core (CVE-2026-119977, CVSS 8.1) during a full-package core update. Affected versions staged new files in a predictable folder under /wp-content/upgrade/. CISA listed it in KEV on 3 Nov 2026 (due 6 Nov 2026; ransomware use Unknown; forensic triage required). CISA has not described the activity it observed. Wordfence said (28-29 Oct 2026) threat actors were actively attempting to exploit it: more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours. As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence. Patchstack would not call the seconds-long race practical to exploit.","action":"Update to 7.1.4 or the fixed release for your branch (backports through 4.7.39, 28 Oct 2026) and confirm the update completed. Before updating an unpatched site, deny web access to /wp-content/upgrade/ at the web server (a PHP firewall plugin does not protect the staged copy) and disable directory listing. CISA KEV due date is 6 Nov 2026 for FCEB agencies. CISA marks forensic triage required: check for unexpected PHP files under /wp-content/upgrade/ (Wordfence and ThreatWire; Patchstack: between updates that folder should hold little more than an index.php)."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-11-03","method":"CISA KEV catalog 2026.11.03, released 2026-11-03T20:00:24Z, dateAdded 2026-11-03, due 2026-11-06, knownRansomwareCampaignUse Unknown, forensicTriage Yes, CWE-367. CISA has not described the activity it observed.","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"third-party-stated","value":"First firewall-rule match 9 minutes after the 28 Oct 2026 20:30 UTC deploy","observer":"Wordfence","date":"2026-10-28","method":"Wordfence telemetry. SecurityWeek (30 Oct 2026) reprints the same figure. Attempts only. Not a vendor or government confirmation of compromise.","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/"},{"metric":"third-party-stated","value":"more than 18,500 requests to staged setup-config.php paths in the first 21 hours","observer":"Wordfence","date":"2026-10-29","method":"Wordfence blog, quoted by SecurityWeek and ThreatWire on 30 Oct 2026. Rolling count of blocked or matched requests. Attempts only. Not a compromise count.","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/"},{"metric":"third-party-stated","value":"20,141 attacks blocked in the past 24 hours when read on 3 Nov 2026","observer":"Wordfence","date":"2026-11-03","method":"Wordfence vulnerability page, read 3 Nov 2026. Rolling 24-hour blocked-attack counter, not a lifetime total. Attempts only.","sourceUrl":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution"},{"metric":"third-party-stated","value":"62,969 attacks blocked in the past 24 hours","observer":"The Hacker News","date":"2026-10-30","method":"The Hacker News (30 Oct 2026) quoting Wordfence. Rolling 24-hour blocked-attack counter. Attempts only. Not a compromise count.","sourceUrl":"https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html"}],"seenInTheWildLinks":[{"title":"CISA Known Exploited Vulnerabilities catalog (CVE-2026-119977 listed 3 Nov 2026)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","observer":"CISA","metric":"exploitation-confirmed"},{"title":"Wordfence: WordPress Core 4.7.0-7.1.3 upgrade-window RCE","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution","observer":"Wordfence","metric":"third-party-stated"},{"title":"The Hacker News: WordPress RCE draws nearly 63,000 attack attempts in 24 hours","url":"https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html","observer":"The Hacker News","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-03","items":[{"text":"New catalog page for WordPress Core upgrade-window RCE (CVE-2026-119977 / GHSA-4w3m-c66w-69mg).","headline":"New catalog page for WordPress Core upgrade-window RCE","section":"overview","date":"2026-11-03","addedDate":"2026-11-03","kind":"page"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-11-03","addedDate":"2026-11-03","kind":"page"},{"text":"CISA added CVE-2026-119977 (WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability) to the Known Exploited Vulnerabilities catalog on 3 Nov 2026 (catalog 2026.11.03, released 2026-11-03T20:00:24Z). dateAdded 2026-11-03, dueDate 2026-11-06. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-367. CISA has not described the activity it observed. Verified 3 Nov 2026.","headline":"CISA listed CVE-2026-119977 in KEV on 3 Nov 2026, due 6 Nov 2026","section":"exploitation","date":"2026-11-03","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","addedDate":"2026-11-03"},{"text":"The 3 Nov 2026 CISA KEV listing is confirmed exploitation evidence from CISA. CISA has not described the activity it observed. Wordfence said (28-29 Oct 2026) threat actors were actively attempting to exploit it: more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours. As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence. Patchstack (28 Oct 2026) would not call the seconds-long race practical to exploit.","headline":"KEV listing is confirmed exploitation; Wordfence reported attempts only (28-30 Oct)","section":"exploitation","date":"2026-11-03","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/","addedDate":"2026-11-03"},{"text":"CISA KEV due date is 6 Nov 2026. Fix and mitigations are unchanged: WordPress 7.1.4 and branch fixes back to 4.7.39 (28 Oct 2026); block web access to /wp-content/upgrade/ and confirm the core update completed. CISA marks forensic triage required. Wordfence and ThreatWire already say to hunt unexpected PHP files under wp-content/upgrade/; Patchstack says between updates that folder should hold little more than an index.php. No attacker IOCs were published.","headline":"KEV due 6 Nov 2026; check unexpected files under the upgrade staging path","section":"priority","date":"2026-11-03","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","addedDate":"2026-11-03"}]},"whatTheBugIs":"CVE-2026-119977 is an unauthenticated remote code execution flaw in WordPress Core versions 4.7 through 7.1.3. WordPress 7.1.4 (28 Oct 2026) and GitHub advisory GHSA-4w3m-c66w-69mg (29 Oct 2026) describe a race during a core update that uses a complete package: the new files were extracted to a predictable directory inside the web-served upgrade folder. An unauthenticated attacker who wins that race can reach remote code execution. NVD (published 31 Oct 2026, lastModified 2 Nov 2026, status Deferred, checked 3 Nov 2026) republishes the Wordfence CNA description and maps the issue to CWE-367 (TOCTOU). Credit: Umut Bayram. Wordfence names Picus Security as the affiliation.\n\nWordfence: during a full-package core update, affected versions unpack the new files into a predictable directory beneath wp-content/upgrade. That temporary copy includes the WordPress installer. Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at the right moment can interact with the staged copy and progress to PHP code execution as the web-server user. This page does not republish exploit code, payloads, or step-by-step weaponisation.\n\nPreconditions, from Wordfence and Patchstack: no account and no user interaction. A full-package core update must be running (Patchstack: unattended background updates count). wp-content/upgrade/ must be reachable over the web and must run PHP. The attacker must know or guess the folder name and win a race that Wordfence measured as seconds in lab environments (CVSS AC:H). Patchstack scored the same high attack complexity and would not call it practical to exploit. GitHub advisory GHSA-4w3m-c66w-69mg labels the issue Low and publishes no CVSS vector.\n\nThe fix, from Wordfence, Patchstack, and ThreatWire: WordPress randomises the staging folder name (Patchstack: 16 random characters), keeps or recreates the index.php listing guard, and stops copying wp-config.php out of the working directory. ThreatWire cites commit e7b33f536d on the 7.1 branch (28 Oct 2026 14:54 UTC). The same fix shipped for every branch back to 4.7.39. WordPress 4.6 and earlier no longer receive security updates.\n\nWordfence assigned CVE-2026-119977 and rates it CVSS 3.1 8.1 High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD stores that metric as the Primary CNA score (source security@wordfence.com). FIRST EPSS on 3 Nov 2026: score 0.00600, 48.75th percentile (checked 3 Nov 2026).\n\nExploitation status: CISA listed CVE-2026-119977 in the Known Exploited Vulnerabilities catalog on 3 Nov 2026 (catalog 2026.11.03, released 2026-11-03T20:00:24Z, dateAdded 2026-11-03, dueDate 2026-11-06). knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-367. CISA vulnerabilityName: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability. CISA has not described the activity it observed. Under this site's method (https://vuln2shell.com/method), a KEV listing is confirmed exploitation evidence from CISA. The glance badge is Exploited in the wild.\n\nWordfence said (28-29 Oct 2026) threat actors were actively attempting to exploit it: more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours. Wordfence deployed a firewall rule on 28 Oct 2026 at 20:30 UTC and recorded the first match nine minutes later. The Wordfence vulnerability page showed 20,141 attacks blocked in the past 24 hours when read on 3 Nov 2026 (a rolling counter). The Hacker News (30 Oct 2026) reported Wordfence blocked 62,969 attacks over the past 24 hours. As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence. Patchstack (28 Oct 2026) scored high attack complexity and would not call the seconds-long race practical to exploit.\n\nPublic PoC: ThreatWire (30 Oct 2026) searched GitHub, X, Exploit-DB, Nuclei rules, and Metasploit pull requests and found no public exploit. The Sploitus wordpress-core-update-rce-check entry (31 Oct 2026, https://sploitus.com/exploit?id=DA3B735A-90EB-578C-B46E-1FE3F55DD9B1) is a non-intrusive version checker; it states it is not an RCE exploit and is not indexed here as one. The glance badge is No public PoC indexed.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Unauthenticated HTTP","detail":"Network access to a WordPress site. No account. No user interaction."},{"id":"app","label":"Full-package core update","detail":"A complete-package core update is running, including background auto-updates. New files land under /wp-content/upgrade/."},{"id":"exploit","label":"Staged installer race","detail":"The attacker polls for the temporary staged copy. If they win the seconds-long race they reach the staged installer. Conceptual impact class only."},{"id":"shell","label":"PHP as the web-server user","detail":"Wordfence: PHP code execution on the server as the web-server user."}]},"exploitation":{"kev":{"listed":true,"date":"2026-11-03","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA listed CVE-2026-119977 (WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability) on 3 Nov 2026, due 6 Nov 2026. Catalog 2026.11.03 (released 2026-11-03T20:00:24Z). knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-367. CISA has not described the activity it observed. Verified 3 Nov 2026."},"firstSeen":{"date":"2026-10-28","source":"Wordfence (quoted by SecurityWeek and ThreatWire)","note":"Wordfence said (28-29 Oct 2026) threat actors were actively attempting to exploit it: more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours. Wordfence deployed a firewall rule on 28 Oct 2026 at 20:30 UTC. The first match arrived nine minutes later. The Wordfence vulnerability page showed 20,141 attacks blocked in the past 24 hours when read on 3 Nov 2026 (a rolling counter). The Hacker News (30 Oct 2026) reported Wordfence blocked 62,969 attacks over the past 24 hours. Attempts only. As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence. WordPress: no statement of observed compromise. CISA listed CVE-2026-119977 in KEV on 3 Nov 2026 (catalog 2026.11.03, due 6 Nov 2026). CISA has not described the activity it observed. Patchstack (28 Oct 2026) would not call the seconds-long race practical to exploit. First calendar day of successful compromise: not verified.","dateLabel":"First attempts"},"vendorStatements":[{"vendor":"WordPress","date":"2026-10-28","statement":"A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window, reported by Umut Bayram.","url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","retracted":false},{"vendor":"WordPress","date":"2026-10-29","statement":"During a core update that uses a complete package, WordPress extracted the new files to a predictable directory inside the web-served upgrade folder. An unauthenticated attacker who wins a race against that extraction could reach remote code execution. WordPress 7.1.4 has been released containing a fix, and as a courtesy the fix has been backported to all branches back to 4.7.","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","retracted":false},{"vendor":"CISA","date":"2026-11-03","statement":"CISA KEV catalog 2026.11.03 (released 2026-11-03T20:00:24Z) lists CVE-2026-119977. vulnerabilityName: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability. dateAdded 2026-11-03. dueDate 2026-11-06. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-367. CISA has not described the activity it observed.","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","retracted":false}]},"timeline":[{"date":"2026-10-28T14:54:23Z","event":"Commit e7b33f536d landed on the WordPress 7.1 branch: improve handling of the upgrade working directory. Merges [64877]. Props include umut3806.","source":{"title":"Upgrade/Install: Improve the handling of the upgrade working directory","url":"https://github.com/WordPress/wordpress-develop/commit/e7b33f536d308e9656442677edefdcfe1d4fa130","publisher":"WordPress"},"kind":"patch","addedDate":"2026-11-03"},{"date":"2026-10-28","event":"WordPress 7.1.4 released. Security release includes a race during core updates that can lead to remote code execution. Credit: Umut Bayram. Backports listed through 4.7.39. WordPress 4.6 and earlier no longer receive security updates.","source":{"title":"Version 7.1.4","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","publisher":"WordPress"},"kind":"patch","key":true,"addedDate":"2026-11-03"},{"date":"2026-10-28","event":"WordPress news post for 7.1.4. Names the upgrade-window remote code execution weakness and credits Umut Bayram. Last modified 29 Oct 2026. That post still says backports are in progress; the documentation page and GHSA list the backport versions as released.","source":{"title":"WordPress 7.1.4","url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","publisher":"WordPress"},"kind":"advisory","addedDate":"2026-11-03"},{"date":"2026-10-28","event":"Patchstack published its 7.1.4 write-up. Upgrade-process race needs no account; the window is seconds; wp-content/upgrade/ must be web-reachable. Patchstack would not call it practical to exploit (AC:H). A PHP firewall cannot block the staged copy.","source":{"title":"WordPress 7.1.4 Security Release","url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","publisher":"Patchstack"},"kind":"advisory","addedDate":"2026-11-03"},{"id":"exploitation-attempts","date":"2026-10-28","event":"Wordfence deployed a firewall rule at 20:30 UTC. The first match arrived nine minutes later. Attempts only. No successful compromise reported.","source":{"title":"WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE","url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","publisher":"Wordfence"},"kind":"other","key":true,"addedDate":"2026-11-03"},{"date":"2026-10-29","event":"Wordfence blog: in the first 21 hours after the 28 Oct 20:30 UTC rule, more than 18,500 requests targeted staged setup-config.php paths. Attempts only.","source":{"title":"WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE","url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","publisher":"Wordfence"},"kind":"other","addedDate":"2026-11-03"},{"date":"2026-10-29","event":"GitHub advisory GHSA-4w3m-c66w-69mg published by aaronjorbin. Affected 4.7.0 through 7.1.3. Patched versions listed per branch through 4.7.39. Advisory severity Low. No CVE id on the advisory when we opened it. Credit: Umut Bayram.","source":{"title":"A race condition during core updates that could lead to remote code execution","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","publisher":"WordPress"},"kind":"advisory","key":true,"addedDate":"2026-11-03"},{"date":"2026-10-30","event":"SecurityWeek: threat actors are attempting to exploit the race within hours of the patches. Quotes Wordfence's nine-minute first hit and 18,500+ requests. Wordfence has not reported successful compromises. No CVE in that article yet.","source":{"title":"Fresh WordPress Vulnerability in Attackers' Crosshairs","url":"https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/","publisher":"SecurityWeek"},"kind":"other","addedDate":"2026-11-03"},{"date":"2026-10-30","event":"ThreatWire: no public exploit found after searching GitHub, X, Exploit-DB, Nuclei rules, and Metasploit pull requests. Cites commit e7b33f536d. Notes the last update can still be unpacked by unpatched code. ThreatWire published before the CVE was assigned.","source":{"title":"WordPress 7.1.4 fixes an unauthenticated RCE race during core updates","url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","publisher":"ThreatWire"},"kind":"other","addedDate":"2026-11-03"},{"date":"2026-10-30","event":"The Hacker News: Wordfence said it blocked 62,969 attacks targeting the vulnerability over the past 24 hours. Rolling 24-hour counter. Attempts only.","source":{"title":"WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours","url":"https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-11-03"},{"date":"2026-10-30","event":"Historical check: against KEV catalog 2026.10.30 (released 2026-10-30T17:02:45.3665Z, 1,766 entries; rechecked 3 Nov 2026, before the 2026.11.03 release), CVE-2026-119977 was not listed. Superseded by the 3 Nov 2026 listing below.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-11-03"},{"date":"2026-10-31T06:16:34.550Z","event":"NVD published CVE-2026-119977 at 06:16 UTC. CNA Wordfence. CVSS 3.1 8.1 High (Primary). CWE-367. Status when we opened the record on 3 Nov 2026: Deferred. lastModified 2 Nov 2026 16:19 UTC.","source":{"title":"NVD - CVE-2026-119977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977","publisher":"NVD"},"kind":"disclosure","key":true,"addedDate":"2026-11-03"},{"id":"cisa-kev-2026-11-03","date":"2026-11-03","event":"CISA added CVE-2026-119977 (WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability) to the Known Exploited Vulnerabilities catalog (catalog 2026.11.03, released 2026-11-03T20:00:24Z). dateAdded 2026-11-03, dueDate 2026-11-06. knownRansomwareCampaignUse Unknown. forensicTriage Yes. CWE-367. CISA has not described the activity it observed.","source":{"title":"Known Exploited Vulnerabilities Catalog (JSON feed)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-11-03"}],"openNotes":[{"title":"GHSA Low versus Wordfence / NVD 8.1 High","detail":"GitHub advisory GHSA-4w3m-c66w-69mg labels the issue Low and publishes no CVSS vector. Wordfence (CNA) and NVD store CVSS 3.1 8.1 High with AC:H. Patchstack also uses AC:H and would not call the race practical to exploit. Both labels stand as sourced.","sources":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977","date":"2026-10-31","publisher":"NVD"},{"url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","publisher":"Patchstack"}]},{"title":"CVE assigned after the 30 Oct write-ups","detail":"ThreatWire (30 Oct 2026) and SecurityWeek (30 Oct 2026) said no CVE had been assigned. GHSA still showed an empty CVE id when we opened it. NVD published CVE-2026-119977 on 31 Oct 2026 (CNA Wordfence). Those earlier no-CVE sentences were correct on their dates.","sources":[{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"},{"url":"https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/","date":"2026-10-30","publisher":"SecurityWeek"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977","date":"2026-10-31","publisher":"NVD"}]},{"title":"The update to a fixed release can still open the window once","detail":"ThreatWire (30 Oct 2026): the update to 7.1.4 is still unpacked by the current, unpatched code, so that last update can open the window one more time. WordPress does not say this. ThreatWire advises blocking /wp-content/upgrade/ first, then updating.","sources":[{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]},{"title":"WordPress news said backports were in progress","detail":"The 28 Oct 2026 WordPress 7.1.4 news post, last modified 29 Oct 2026, says backports are in progress and will ship as they become ready. The Version 7.1.4 documentation page and GHSA list specific backport versions as released the same day through 4.7.39. This page uses the documentation page and GHSA for the version table.","sources":[{"url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","date":"2026-10-28","publisher":"WordPress"},{"url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","date":"2026-10-28","publisher":"WordPress"},{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"}]},{"title":"4.6 and earlier: no fix; GHSA range starts at 4.7.0","detail":"GHSA and Wordfence name this RCE from 4.7.0 through 7.1.3. WordPress says 4.6 and earlier no longer receive security updates. Patchstack says the upgrade-folder sink dates back to WordPress 2.8; that is Patchstack's analysis, not a vendor affected statement for 2.8 through 4.6. Affected status for 4.6 and earlier is not confirmed by WordPress; the GHSA range starts at 4.7.0. Migrate to a supported branch.","sources":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"},{"url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","date":"2026-10-28","publisher":"WordPress"},{"url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","publisher":"Patchstack"}]},{"title":"DISALLOW_FILE_MODS is ThreatWire's reading","detail":"ThreatWire (30 Oct 2026): sites that set DISALLOW_FILE_MODS do not run the in-place updater and, in ThreatWire's reading, should not be exposed to this bug. WordPress does not say this.","sources":[{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]}],"defenderActions":[{"title":"Update to the fixed release for your branch and confirm it completed","detail":"Install WordPress 7.1.4 or the GHSA/WordPress-listed backport for your branch (7.0.8 through 4.7.39). Confirm Dashboard, Updates or wp core version shows that build. Do not assume a background auto-update finished. WordPress 4.6 and earlier get no fix; migrate to a supported release.","priority":"now","links":[{"label":"WordPress 7.1.4","href":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},{"label":"GHSA-4w3m-c66w-69mg","href":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg"}]},{"title":"Before updating an unpatched site, deny web access to /wp-content/upgrade/ at the web server","detail":"Patchstack and ThreatWire: block /wp-content/upgrade/ at the web server or virtual host, not with a PHP firewall plugin. WordPress needs filesystem access to that folder, not web access. ThreatWire: the update to a fixed release is still unpacked by the current unpatched code, so that last update can open the window once more. Do not put the deny rule inside the upgrade folder; pre-7.1.4 cleanup deletes that folder's contents before each unpack.","priority":"now","links":[{"label":"Patchstack 7.1.4","href":"https://patchstack.com/articles/wordpress-7-1-4-security-release/"},{"label":"ThreatWire","href":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates"}]},{"title":"Disable directory listing on /wp-content/upgrade/","detail":"Patchstack: check that wp-content/upgrade/ is not listable. Between updates the folder should hold little more than an index.php.","priority":"now","links":[{"label":"Patchstack 7.1.4","href":"https://patchstack.com/articles/wordpress-7-1-4-security-release/"}]},{"title":"On Wordfence, enable Extended Protection","detail":"Wordfence: this request hits a staged PHP file without loading WordPress, so a plugin firewall that runs inside WordPress will not see it unless Extended Protection is on. The rule ID is not published. Wordfence Free receives the rule on 27 Nov 2026. Receiving the rule does not replace the security update.","priority":"now","links":[{"label":"Wordfence blog","href":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/"}]},{"title":"Check for unexpected files under the upgrade staging path","detail":"CISA marks forensic triage required for this KEV listing and has not described the activity it observed. Wordfence and ThreatWire already say to hunt unexpected PHP files under wp-content/upgrade/, including files you did not place. Patchstack: between updates that folder should hold little more than an index.php. No attacker IPs, hashes, or user-agents were published.","priority":"now","links":[{"label":"Wordfence blog","href":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/"},{"label":"ThreatWire","href":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates"},{"label":"CISA KEV catalog","href":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}]}],"detection":[{"title":"PHP requests under /wp-content/upgrade/","detail":"Wordfence and ThreatWire: look for requests to PHP files under /wp-content/upgrade/, especially staged setup-config.php or install.php. ThreatWire: any 200 response is a red flag; compare the time with your update times. A request is an attempt lead, not proof of code execution.","logSource":"Web server or WAF access logs for PHP under /wp-content/upgrade/","kind":"generic","group":"web-proxy","url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29"},{"title":"wp-config.php pointing at an unknown database host","detail":"ThreatWire: if a site ran an update before it was patched, check DB_HOST, DB_NAME, and DB_USER in wp-config.php. A database host you do not recognise points to a takeover. Host-side review only.","logSource":"Host file review of wp-config.php","kind":"generic","group":"edr","url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","fold":"compromise-check"},{"title":"Unexpected administrator accounts, plugins, or PHP files","detail":"Wordfence and ThreatWire: hunt administrator accounts you did not create, unexpected plugins, and PHP files you did not place, including under wp-content/upgrade/. A new account or file is a lead, not proof of this bug.","logSource":"WordPress users table, plugin directory, and host file inventory","kind":"generic","group":"edr","url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","fold":"compromise-check"},{"title":"Wordfence firewall rule (ID not published)","detail":"Wordfence deployed a blocking rule on 28 Oct 2026 at 20:30 UTC. The rule ID is not published. It only sees this request when Extended Protection is on, because the request skips WordPress loading. Wordfence Free receives the rule on 27 Nov 2026. The rule does not replace the update.","logSource":"Wordfence firewall logs","kind":"vendor-signature","url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29"},{"title":"No public Nuclei or Sigma rule","detail":"None public as of 3 Nov 2026. ThreatWire found none on 30 Oct 2026. A GitHub search for CVE-2026-119977 Nuclei or Sigma rules did not surface a published rule. Do not invent one from the advisory. Use the hunting pointers and path-hunt queries on this page.","logSource":"Public rule indexes (Nuclei, Sigma)","kind":"generic","date":"2026-11-03","dateKind":"checked"}],"detectionRules":[{"id":"v2s-sigma-wordpress-upgrade-path-php","title":"WordPress upgrade-path PHP request","language":"sigma","query":"title: WordPress upgrade-path PHP request (CVE-2026-119977 hunt)\nid: 9e1c4b70-6a2d-4f11-9c3e-2b8f0d41a6c1\nstatus: experimental\ndescription: Detects HTTP requests to PHP files under /wp-content/upgrade/. Path hunt only. Not a payload detector.\nreferences:\n    - https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/\n    - https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates\nauthor: vuln2shell\ndate: 2026-11-03\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-uri-stem|contains: '/wp-content/upgrade/'\n        cs-uri-stem|endswith: '.php'\n    condition: selection\nfalsepositives:\n    - Leftover staging folders from failed updates\n    - Admin or backup tools that read that path\nlevel: high","logSource":"Web server or WAF access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. A request is not proof of compromise. Tune field names to your shipper.","tested":"untested"},{"id":"v2s-spl-wordpress-upgrade-path-php","title":"WordPress upgrade-path PHP request (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=aws:waf:logs)\n(\"/wp-content/upgrade/\") (\".php\")\n| search uri_path=\"*wp-content/upgrade/*\" uri_path=\"*.php\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src values(status) as status by host, uri_path\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web server or WAF access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. ThreatWire: treat a 200 on staged setup-config.php or install.php as a lead and compare it with update times.","tested":"untested"},{"id":"v2s-kql-wordpress-upgrade-path-php","title":"WordPress upgrade-path PHP request (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated > ago(14d)\n| where csUriStem has \"/wp-content/upgrade/\"\n| where csUriStem endswith \".php\"\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, cIP, csUriStem, scStatus\n| order by count_ desc","logSource":"Web server access logs shipped to Microsoft Sentinel / Defender","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Tune the table name to your connector.","tested":"untested"},{"id":"v2s-esql-wordpress-upgrade-path-php","title":"WordPress upgrade-path PHP request (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE url.path LIKE \"/wp-content/upgrade/%\" AND url.path LIKE \"%.php\"\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip, url.path, http.response.status_code\n| SORT count DESC","logSource":"Web server or Elastic Common Schema access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Tune the index pattern and field names to your shipper.","tested":"untested"},{"id":"v2s-suricata-wordpress-upgrade-path-php","title":"WordPress upgrade-path PHP request (Suricata)","language":"suricata","query":"alert http any any -> any any (msg:\"vuln2shell CVE-2026-119977 upgrade-path PHP request\"; flow:established,to_server; http.uri; content:\"/wp-content/upgrade/\"; content:\".php\"; distance:0; classtype:web-application-attack; sid:26119771; rev:1;)","logSource":"HTTP URI visible to Suricata (cleartext or TLS-intercept)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29","license":"CC0 1.0","origin":"vuln2shell","notes":"URI path hunt only. Will not see HTTPS without intercept. A match is a lead, not proof of compromise.","tested":"untested"}],"detectionLinks":[],"retrohunt":{"summary":"Wordfence recorded the first firewall match about nine minutes after 20:30 UTC on 28 Oct 2026. Hunt web and WAF logs from that day for PHP requests under /wp-content/upgrade/, and review wp-config.php, administrators, plugins, and unexpected PHP files on hosts that ran a core update while unpatched.","lookback":{"from":"2026-10-28","basis":"first-attempt","rationale":"Wordfence deployed its rule at 20:30 UTC on 28 Oct 2026 and recorded the first match nine minutes later. That is the first dated attempt window in the sources we opened.","sources":[{"url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","publisher":"Wordfence"},{"url":"https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/","date":"2026-10-30","publisher":"SecurityWeek"}]},"logSources":[{"name":"Web server or WAF access logs","why":"Wordfence and ThreatWire name PHP requests under /wp-content/upgrade/, especially staged setup-config.php.","required":true},{"name":"Host copy of wp-config.php","why":"ThreatWire: an unexpected DB_HOST, DB_NAME, or DB_USER is a takeover lead.","required":false},{"name":"WordPress users, plugins, and PHP file inventory","why":"Wordfence and ThreatWire: unexpected administrators, plugins, or PHP files.","required":false}],"steps":[{"title":"Search access logs from 28 Oct 2026 for PHP under /wp-content/upgrade/","detail":"Wordfence: attackers polled staged installer paths. ThreatWire: note any 200 on setup-config.php or install.php and compare it with update times. A hit is a lead, not proof.","sources":[{"url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","publisher":"Wordfence"},{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]},{"title":"On hosts that ran a core update while unpatched, review wp-config.php and admins","detail":"ThreatWire: check DB_HOST, DB_NAME, and DB_USER; new administrator accounts; unexpected plugins or PHP files, including under wp-content/upgrade/.","sources":[{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]}],"queries":[{"id":"v2s-retro-sigma-wordpress-upgrade-path-php","title":"WordPress upgrade-path PHP request (lookback)","language":"sigma","query":"title: WordPress upgrade-path PHP request lookback (CVE-2026-119977)\nid: 3a6d1e88-2c4f-4b09-8d71-5e0a9c2b1740\nstatus: experimental\ndescription: Lookback hunt for HTTP requests to PHP files under /wp-content/upgrade/ from 28 Oct 2026.\nreferences:\n    - https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/\nauthor: vuln2shell\ndate: 2026-11-03\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-uri-stem|contains: '/wp-content/upgrade/'\n        cs-uri-stem|endswith: '.php'\n    condition: selection\nfalsepositives:\n    - Leftover staging folders from failed updates\nlevel: high","logSource":"Web server or WAF access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29","license":"CC0 1.0","origin":"vuln2shell","notes":"Same path hunt as live detection, scoped from 28 Oct 2026.","tested":"untested","timeRange":"From 28 Oct 2026 (Wordfence first-attempt window) through your last unpatched core update"}],"artefacts":[{"kind":"web-log","value":"/wp-content/upgrade/*.php","detail":"Wordfence: requests targeting staged installer paths under wp-content/upgrade, including setup-config.php.","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29"},{"kind":"file","value":"wp-config.php","detail":"ThreatWire: a database host, name, or user you do not recognise after an update window.","sourceUrl":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","sourceDate":"2026-10-30"},{"kind":"account","value":"Unexpected WordPress administrator","detail":"ThreatWire and Wordfence: administrator accounts you did not create.","sourceUrl":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","sourceDate":"2026-10-30"}],"iocNote":"Wordfence did not publish attacker IPs, hashes, or user-agents in the sources we opened. Do not invent IOCs.","hitMeaning":[{"level":"attempt","detail":"A PHP request to /wp-content/upgrade/ with no 200 on a staged installer and no wp-config.php or admin change."},{"level":"likely-compromise","detail":"A 200 response to staged setup-config.php or install.php under /wp-content/upgrade/ during an update window, as ThreatWire flags."},{"level":"compromise","detail":"wp-config.php pointing at an unknown database host, or unexpected administrators, plugins, or PHP files after an unpatched update window. Independent validation of a successful in-the-wild compromise: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Deny web access to /wp-content/upgrade/ and install the fixed release","detail":"Patchstack and ThreatWire: block the folder at the web server, then update to 7.1.4 or your branch backport and confirm it completed.","links":[{"label":"Patchstack 7.1.4","href":"https://patchstack.com/articles/wordpress-7-1-4-security-release/"},{"label":"Version 7.1.4","href":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"}]},{"title":"Preserve access logs and wp-config.php from before any restore","detail":"Keep the logs that show PHP under /wp-content/upgrade/ and a copy of wp-config.php from the exposure window.","links":[{"label":"ThreatWire","href":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates"}]}],"limits":["Wordfence published no attacker IPs.","A request to /wp-content/upgrade/ is not proof of code execution.","CISA listed CVE-2026-119977 as known exploited on 3 Nov 2026 but has not described the activity. As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence.","The Sploitus version checker is not an exploit and is not a hunting rule."],"sources":[{"url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","publisher":"Wordfence"},{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}],"updatedAt":"2026-11-03"},"amIAffected":{"summary":"WordPress Core 4.7.0 through 7.1.3 is in scope for CVE-2026-119977. The fix is 7.1.4 or the GHSA-listed backport for your branch through 4.7.39. Preconditions: a full-package core update can run, and /wp-content/upgrade/ is web-reachable with PHP. WordPress 4.6 and earlier get no fix.","checks":[{"id":"v2s-aia-wordpress-core-upgrade-window-rce-version-1","kind":"version","title":"Record the installed WordPress version against the fixed release for that branch","detail":"Compare Dashboard, Updates or WP-CLI to 7.1.4, or to the GHSA backport for your branch (7.0.8 through 4.7.39). This is inventory only.","command":"wp core version","affectedMeans":"The installed WordPress version is 4.7.0 through 7.1.3, or another 4.7-and-later build below the fixed release for that branch.","fixedMeans":"The installed version is 7.1.4, or the GHSA/WordPress-listed backport for that branch, or a later supported release.","notes":"Do not assume a background auto-update finished. WordPress 4.6 and earlier get no fix. Do not send requests to staged installer files.","sources":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"},{"url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","date":"2026-10-28","publisher":"WordPress"}]},{"id":"v2s-aia-wordpress-core-upgrade-window-rce-package-2","kind":"package","title":"Read $wp_version from wp-includes/version.php","detail":"Read-only file inventory when WP-CLI is not available. Compare $wp_version to the fixed release for that branch.","command":"grep -m1 \"$wp_version =\" wp-includes/version.php","affectedMeans":"$wp_version is 4.7.0 through 7.1.3, or another 4.7-and-later build below the fixed release for that branch.","fixedMeans":"$wp_version is 7.1.4, the GHSA/WordPress-listed backport for that branch, or a later supported release.","notes":"Inventory only. A version string does not prove the update finished cleanly.","sources":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"}]},{"id":"v2s-aia-wordpress-core-upgrade-window-rce-config-3","kind":"config","title":"Record whether the web server allows HTTP to /wp-content/upgrade/","detail":"Patchstack and ThreatWire: the race needs the staging directory to be web-reachable with PHP. Read the vhost or server config for a deny on that path. Do not request PHP files under it.","command":"On each WordPress vhost, record whether the server config denies HTTP to /wp-content/upgrade/ (nginx location, Apache Directory/Require, or a site-root rewrite). Do not request PHP files under that path.","affectedMeans":"The site is on 4.7.0 through 7.1.3 and /wp-content/upgrade/ is still allowed over HTTP with PHP execution.","fixedMeans":"The site is on a fixed release, or the web server denies HTTP to /wp-content/upgrade/ (workaround only).","notes":"Web reachability is a precondition, not proof of compromise. A PHP firewall plugin does not protect the staged copy.","sources":[{"url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","publisher":"Patchstack"},{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]},{"id":"v2s-aia-wordpress-core-upgrade-window-rce-exposure-4","kind":"exposure","title":"Scoped product search for WordPress in your own ranges","detail":"Product fingerprint only, not a vulnerable count. Scope the query to your estate. No sourced vuln-specific dork was published.","command":"shodan search 'http.component:\"WordPress\" net:<your-range>'","affectedMeans":"A host in your range runs WordPress 4.7.0 through 7.1.3 (confirm the version on the host).","fixedMeans":"No WordPress host in your range, or every host is on 7.1.4 or the fixed release for its branch.","notes":"A product match is not a version match. Confirm $wp_version on each host. Do not probe /wp-content/upgrade/ from the internet.","sources":[{"url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","publisher":"Wordfence"}]}],"limits":["GHSA and Wordfence name this RCE from 4.7.0. 4.6 and earlier get no fix. Affected status is not confirmed by WordPress; the GHSA range starts at 4.7.0.","A Shodan product match is not a vulnerable count.","Do not request staged installer PHP files.","ThreatWire's DISALLOW_FILE_MODS reading is not a WordPress statement."],"sources":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"},{"url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","date":"2026-10-28","publisher":"WordPress"},{"url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","publisher":"Patchstack"}],"updatedAt":"2026-11-03","addedDate":"2026-11-03"},"mitigations":{"summary":"Until you can install the fixed release, deny web access to /wp-content/upgrade/ at the web server and disable directory listing. A PHP firewall plugin does not protect the staged copy. ThreatWire: block the folder before you update, because the last update is still unpacked by unpatched code.","items":[{"title":"Deny web access to /wp-content/upgrade/ at the web server","detail":"Patchstack: block it at the web server and check the directory is not listable. ThreatWire: WordPress only needs filesystem access to that folder. Put the rule in the server or virtual host config, or in the site-root rewrite file. Do not put a deny file inside wp-content/upgrade/; pre-7.1.4 cleanup deletes that folder's contents before each unpack.","limits":"Not a software fix. Does not help if the folder is already reachable while an update is running. ThreatWire: the update to a fixed release can still open the window once. Still install 7.1.4 or your branch backport.","verify":"A GET to the /wp-content/upgrade/ directory on your own site returns 403. ThreatWire: HTTP 403 can also mean listing is off, so confirm the server deny covers the whole subtree, including PHP. Do not request installer PHP files.","source":{"url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","publisher":"Patchstack"}},{"title":"Disable directory listing on /wp-content/upgrade/","detail":"Patchstack: check that wp-content/upgrade/ is not listable. Between updates the folder should hold little more than an index.php.","limits":"Not a software fix. Listing off does not stop a request to a guessed PHP path. Still deny the subtree and install the fixed release.","verify":"Directory listing is off for /wp-content/upgrade/ in the vhost, and a GET of that directory does not return a file list.","source":{"url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","publisher":"Patchstack"}},{"title":"Do not rely on a PHP firewall plugin for this path","detail":"Patchstack: the extracted copy loads WordPress from its own files, so the site's firewall never runs for that request. Wordfence: enable Extended Protection if you use its plugin; the rule still does not replace the update. Wordfence Free receives the rule on 27 Nov 2026.","limits":"Extended Protection is a Wordfence product control, not a core fix. It does not help sites without that plugin, and it does not close the race in core.","verify":"On Wordfence sites, the firewall is on with Extended Protection. On every site, the web server deny is in place and the installed version is the fixed release for that branch.","source":{"url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","publisher":"Wordfence"}}],"updatedAt":"2026-11-03","addedDate":"2026-11-03"},"response":{"summary":"If a site ran a core update while still on 4.7.0 through 7.1.3, deny web access to /wp-content/upgrade/, install the fixed release, and hunt PHP requests under that path plus wp-config.php, administrators, plugins, and unexpected PHP files. CISA listed CVE-2026-119977 as known exploited on 3 Nov 2026 but has not described the activity it observed. As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence. No sourced in-the-wild persistence list was published.","containment":[{"title":"Deny web access to /wp-content/upgrade/ at the web server","detail":"Patchstack and ThreatWire: block the folder at the server, not with a PHP plugin, including while you finish the update.","sources":[{"url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","publisher":"Patchstack"},{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]},{"title":"Install the fixed release for the branch and confirm it completed","detail":"WordPress 7.1.4 or the GHSA backport through 4.7.39. Confirm Dashboard, Updates or wp core version. WordPress 4.6 and earlier get no fix.","sources":[{"url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","date":"2026-10-28","publisher":"WordPress"},{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"}]},{"title":"Hunt PHP requests under /wp-content/upgrade/ around update times","detail":"Wordfence and ThreatWire: review access logs for staged setup-config.php or other PHP under that path. A 200 is a lead, not proof.","sources":[{"url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","publisher":"Wordfence"},{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]}],"rotate":[{"item":"Database credentials and secrets the web-server user could reach","reason":"General: if PHP ran as the web-server user, treat secrets in wp-config.php and on the host as exposed. No bug-specific rotate list was published in the sources we opened.","generic":true,"sources":[{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]}],"observedBehaviour":[{"title":"Polling of staged setup-config.php paths","detail":"Wordfence: two of the largest sources repeatedly polled small groups of sites for about 14.5 hours, consistent with trying to catch the upgrade window. Other sources tested many staging-directory and version-name variations. Not every request used the exact vulnerable path.","sourceUrl":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","sourceDate":"2026-10-29"}],"evidence":[{"title":"Installed WordPress version from before the update","detail":"Keep Dashboard, Updates or $wp_version so you can show whether the host was 4.7.0 through 7.1.3 during an update window.","sources":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","publisher":"WordPress"}]},{"title":"Web and WAF logs for PHP under /wp-content/upgrade/","detail":"Keep requests to staged setup-config.php or install.php from 28 Oct 2026 onward, with status codes and timestamps next to update times.","sources":[{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]},{"title":"wp-config.php and administrator inventory from the exposure window","detail":"ThreatWire: keep DB_HOST / DB_NAME / DB_USER and the administrator list from before any restore. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"}]}],"limits":["No published attacker IPs, hashes, or user-agents.","As of 30 Oct 2026, SecurityWeek and ThreatWire reported no successful compromise from Wordfence.","CISA listed CVE-2026-119977 in KEV on 3 Nov 2026 (catalog 2026.11.03, due 6 Nov 2026) and has not described the activity it observed.","No public working exploit indexed."],"sources":[{"url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","publisher":"Wordfence"},{"url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","publisher":"ThreatWire"},{"url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","date":"2026-10-28","publisher":"WordPress"}],"updatedAt":"2026-11-03","addedDate":"2026-11-03"},"bulletins":[{"vendor":"WordPress","title":"WordPress 7.1.4","url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","date":"2026-10-28","cve":"CVE-2026-119977"},{"vendor":"WordPress","title":"GHSA-4w3m-c66w-69mg","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","cve":"CVE-2026-119977"},{"vendor":"Wordfence","title":"WordPress 7.1.4 security release RCE","url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","cve":"CVE-2026-119977"},{"vendor":"CISA","title":"Known Exploited Vulnerabilities catalog (CVE-2026-119977)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","date":"2026-11-03","cve":"CVE-2026-119977"}],"coverage":[{"title":"Version 7.1.4","publisher":"WordPress","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","date":"2026-10-28","type":"vendor","addedDate":"2026-11-03"},{"title":"WordPress 7.1.4","publisher":"WordPress","url":"https://wordpress.org/news/2026/10/wordpress-7-1-4/","date":"2026-10-28","type":"vendor","addedDate":"2026-11-03"},{"title":"GHSA-4w3m-c66w-69mg","publisher":"WordPress","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","date":"2026-10-29","type":"vendor","addedDate":"2026-11-03"},{"title":"WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE","publisher":"Wordfence","url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","date":"2026-10-29","type":"research","addedDate":"2026-11-03"},{"title":"WordPress Core 4.7.0-7.1.3 upgrade-window staged-installer RCE","publisher":"Wordfence","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution","date":"2026-10-31","type":"research","addedDate":"2026-11-03"},{"title":"WordPress 7.1.4 Security Release","publisher":"Patchstack","url":"https://patchstack.com/articles/wordpress-7-1-4-security-release/","date":"2026-10-28","type":"research","addedDate":"2026-11-03"},{"title":"WordPress 7.1.4 fixes an unauthenticated RCE race during core updates","publisher":"ThreatWire","url":"https://www.threatwire.tech/news/wordpress-7-1-4-fixes-an-unauthenticated-rce-race-during-core-updates","date":"2026-10-30","type":"news","addedDate":"2026-11-03"},{"title":"Fresh WordPress Vulnerability in Attackers' Crosshairs","publisher":"SecurityWeek","url":"https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/","date":"2026-10-30","type":"news","addedDate":"2026-11-03"},{"title":"NVD - CVE-2026-119977","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977","date":"2026-10-31","type":"government","addedDate":"2026-11-03"},{"title":"CVE-2026-119977","publisher":"Tenable","url":"https://www.tenable.com/cve/CVE-2026-119977","date":"2026-10-31","type":"news","addedDate":"2026-11-03"},{"title":"CVE-2026-119977","publisher":"Rapid7","url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-119977/","date":"2026-10-31","type":"news","addedDate":"2026-11-03"},{"title":"CISA KEV catalog JSON, catalog 2026.10.30 (historical check: not listed then; superseded by catalog 2026.11.03)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-30","type":"government","addedDate":"2026-11-03"},{"title":"Sploitus wordpress-core-update-rce-check (non-intrusive version checker, not an exploit)","publisher":"Sploitus / Grupo Oruss","url":"https://sploitus.com/exploit?id=DA3B735A-90EB-578C-B46E-1FE3F55DD9B1","date":"2026-10-31","type":"news","addedDate":"2026-11-03"},{"title":"WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours","publisher":"The Hacker News","url":"https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html","date":"2026-10-30","type":"news","addedDate":"2026-11-03"},{"title":"CISA KEV catalog JSON (CVE-2026-119977 listed; catalog 2026.11.03)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-03","type":"government","addedDate":"2026-11-03"},{"title":"CISA Known Exploited Vulnerabilities catalog (CVE-2026-119977 listed 3 Nov 2026)","publisher":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","date":"2026-11-03","type":"government","addedDate":"2026-11-03"}],"posts":[],"research":[{"title":"A race condition during core updates that could lead to remote code execution","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg","authors":"Umut Bayram","date":"29 Oct 2026"},{"title":"WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE","url":"https://www.wordfence.com/blog/2026/10/wordpress-7-1-4-security-release-rce/","authors":"Wordfence (researcher credit: Umut Bayram, Picus Security)","date":"29 Oct 2026"}],"impact":{"kind":"single-product","product":"WordPress Core","versions":[{"version":"WordPress 7.1 (7.1.0 through 7.1.3)","status":"affected","versions":"7.1.4","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 7.0 (7.0.0 through 7.0.7)","status":"affected","versions":"7.0.8","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.9 (6.9.0 through 6.9.10)","status":"affected","versions":"6.9.11","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.8 (6.8.0 through 6.8.11)","status":"affected","versions":"6.8.12","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.7 (6.7.0 through 6.7.10)","status":"affected","versions":"6.7.11","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.6 (6.6.0 through 6.6.10)","status":"affected","versions":"6.6.11","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.5 (6.5.0 through 6.5.13)","status":"affected","versions":"6.5.14","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.4 (6.4.0 through 6.4.13)","status":"affected","versions":"6.4.14","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.3 (6.3.0 through 6.3.13)","status":"affected","versions":"6.3.14","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.2 (6.2.0 through 6.2.14)","status":"affected","versions":"6.2.15","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.1 (6.1.0 through 6.1.15)","status":"affected","versions":"6.1.16","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 6.0 (6.0.0 through 6.0.17)","status":"affected","versions":"6.0.18","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.9 (5.9.0 through 5.9.19)","status":"affected","versions":"5.9.20","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.8 (5.8.0 through 5.8.18)","status":"affected","versions":"5.8.19","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.7 (5.7.0 through 5.7.20)","status":"affected","versions":"5.7.21","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.6 (5.6.0 through 5.6.22)","status":"affected","versions":"5.6.23","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.5 (5.5.0 through 5.5.23)","status":"affected","versions":"5.5.24","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.4 (5.4.0 through 5.4.24)","status":"affected","versions":"5.4.25","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.3 (5.3.0 through 5.3.26)","status":"affected","versions":"5.3.27","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.2 (5.2.0 through 5.2.29)","status":"affected","versions":"5.2.30","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.1 (5.1.0 through 5.1.27)","status":"affected","versions":"5.1.28","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 5.0 (5.0.0 through 5.0.30)","status":"affected","versions":"5.0.31","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 4.9 (4.9.0 through 4.9.34)","status":"affected","versions":"4.9.35","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 4.8 (4.8.0 through 4.8.33)","status":"affected","versions":"4.8.34","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 4.7 (4.7.0 through 4.7.38)","status":"affected","versions":"4.7.39","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/"},"addedDate":"2026-11-03"},{"version":"WordPress 4.6 and earlier","status":"eol-migrate","versions":"No fix (end of life). Affected status not confirmed by WordPress; the GHSA range starts at 4.7.0. Migrate to a supported branch.","vendorStatement":{"date":"28 Oct 2026","url":"https://wordpress.org/documentation/wordpress-version/version-7-1-4/","quote":"WordPress 4.6 and earlier no longer receive security updates."},"addedDate":"2026-11-03"}]},"pocs":[],"pocEmptyState":"No public working exploit indexed. ThreatWire (30 Oct 2026) searched GitHub, X, Exploit-DB, Nuclei rules, and Metasploit pull requests and found no public exploit. The Sploitus wordpress-core-update-rce-check entry (31 Oct 2026, https://sploitus.com/exploit?id=DA3B735A-90EB-578C-B46E-1FE3F55DD9B1) is a non-intrusive version checker; it states it is not an RCE exploit and is not listed here as one. Independent public exploit: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/wordpress-core-upgrade-window-rce","json":"https://vuln2shell.com/vulns/wordpress-core-upgrade-window-rce.json","iocsCsv":"https://vuln2shell.com/vulns/wordpress-core-upgrade-window-rce/iocs.csv","stix":"https://vuln2shell.com/vulns/wordpress-core-upgrade-window-rce/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"No public PoC indexed"}}}