WordPress CVE-2026-119977: Check and Patch Core

note and the fact-check list in the email. - Publish from the Blogger editor so the embedded cover image gets uploaded. -->

WordPress site owners have a narrow but important maintenance task: CVE-2026-119977 is a core race condition that can let an unauthenticated attacker execute code during the full-package upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026, with a federal remediation due date of November 6, 2026. This guide shows you how to check your installed core version, update safely, block web access to upgrade staging paths, and watch logs and files for signs of abuse. It is defensive guidance only, with no proof-of-concept steps.

What the CVE-2026-119977 race condition actually affects

The flaw is a time-of-check time-of-use (TOCTOU) race condition in WordPress Core. During a full-package core upgrade, WordPress stages files in predictable paths that are reachable over the web, then moves them into place. If an attacker requests a staged file in the gap between the check and the final move, the source data says they could execute code on the server.

The exposure is tied to the upgrade window, not every request your site serves. That window can still be long enough to matter on a busy or slow host, especially if an upgrade is interrupted and staging files remain behind. WordPress Core is widely used, and the CISA KEV listing indicates known exploitation. The source data lists ransomware association as unknown, so do not assume this is only a ransomware precursor.

Who is exposed to the WordPress core upgrade-window flaw

Any WordPress installation running an affected core version is in scope. The source data does not publish a version range, so the vendor release notes linked below are the authoritative place to confirm. Your practical exposure is higher when:

• Full-package core upgrades are run from the dashboard, WP-CLI, or a host auto-updater.
• /wp-content/upgrade/ or a similar staging directory is reachable from the public internet.
• Upgrades run on a schedule you do not control, or failed upgrades leave files behind.
• The site is public-facing, even if the admin area is restricted.

Internal sites are not automatically safe. An attacker with network access, or a compromised low-privilege account that can reach the site, may still hit the window. Automatic updates can shorten exposure to an old core version, but they do not guarantee that the upgrade path itself is safe. Ask your host whether core updates use full-package staging and where those files live.

Check the installed WordPress core version first

Record three things before changing anything: the exact core version, the update channel, and whether a host or plugin also manages updates. WP-CLI gives the cleanest answer:

wp core version --path=/var/www/html
wp core check-update --path=/var/www/html

If WP-CLI is not available, open wp-includes/version.php in a file manager and look for the $wp_version value. In WP Admin, the Dashboard and Updates screens show the current version and any offered update. On a managed host, check the host panel too; an auto-update policy can override what you see in WordPress.

Check	Where to look	What to note
Core version	wp core version or Dashboard	Exact version; compare with the vendor advisory
Update offer	wp core check-update or Dashboard > Updates	Whether a patched release is available
Auto-updates	Host control panel or update plugin	Who controls the upgrade window

Apply the core update in a controlled window

Treat this as a short maintenance job, not a background click. Back up files and the database, confirm that you can restore them, then update. If you use WP-CLI, run commands as the same system user that owns the WordPress files. A typical sequence is:

wp maintenance-mode activate --path=/var/www/html
wp core update --path=/var/www/html
wp core update-db --path=/var/www/html
wp core verify-checksums --path=/var/www/html
wp maintenance-mode deactivate --path=/var/www/html

After the update, clear caches, test login, publish a post, upload a file, and check the front end. Then review plugins and themes for compatibility. The verify-checksums step matters because it compares core files against WordPress.org checksums; unexpected modifications can point to a failed upgrade or tampering.

Block web access to predictable upgrade staging paths

Because the vulnerability depends on web-accessible staging, the highest-value hardening step is to deny direct HTTP requests to the upgrade directory. Nginx example:

location ^~ /wp-content/upgrade/ {
    return 403;
}

Add the snippet inside the server block, test with nginx -t, then reload. Apache users can deny the directory with an .htaccess file inside wp-content/upgrade, but confirm that AllowOverride permits it. A WAF rule can add defense in depth, but it is not a substitute for patching.

Also clean up stale staging content. Inspect first; do not blindly delete an active upgrade:

ls -la /var/www/html/wp-content/upgrade/
find /var/www/html/wp-content/upgrade/ -mindepth 1 -maxdepth 1 -type d -mtime +7 -print

Remove only directories you can tie to an old, completed, or failed upgrade, and only after a backup. Keep file ownership with the web user, use 755 for directories and 644 for files, and never leave world-writable files in the web root.

Monitor logs and recently changed PHP files

During the upgrade window, watch for requests to staging paths and update endpoints. A simple access-log search:

grep -Ei 'wp-content/upgrade|wp-admin/update-core|wp-admin/update' /var/log/nginx/access.log

On Windows or IIS, use PowerShell against the IIS log directory:

Select-String -Path C:\inetpub\logs\LogFiles\W3SVC1\*.log -Pattern 'wp-content/upgrade','update-core' | Select-Object -Last 50

Look for a burst of requests from one address, requests after an upgrade should have finished, or staging URLs returning 200. Correlate timestamps with your maintenance window; a single 403 is less interesting than repeated hits followed by a new PHP file.

For files, find PHP modified in the last two hours:

find /var/www/html -type f -name '*.php' -mmin -120 -print

On Windows:

Get-ChildItem -Path C:\inetpub\wwwroot -Recurse -Filter *.php | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-2) } | Select-Object LastWriteTime, FullName

Compare unexpected files against your backup and version control. Do not run an unknown PHP file to see what it does.

If you cannot update WordPress core immediately

Sometimes a plugin, theme, or host constraint blocks the core update. Reduce the attack surface while you resolve it. Block /wp-content/upgrade/ at the web server or WAF, restrict access to wp-admin and wp-login.php by IP or SSO where practical, and schedule the core update as soon as the vendor fix is available. Keep backups current and monitor logs. CISA's required action says to apply vendor mitigations and, if mitigations are unavailable, follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product. That last option is a business decision, not a casual workaround.

Do not disable all updates as a mitigation. That extends exposure to the old core version and makes the next maintenance window riskier.

FAQ: WordPress CVE-2026-119977

Is CVE-2026-119977 being exploited?

CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026, which is a strong signal of known exploitation. The source data lists ransomware use as unknown. Treat the vulnerability as urgent but avoid speculation about specific campaigns or attackers.

Does automatic updating eliminate the race condition?

Not necessarily. Automatic updates shorten the time an outdated core remains installed, but if the updater performs a full-package upgrade with web-accessible staging, the upgrade window still exists. Confirm how your host performs updates, keep the staging path blocked, and verify the core version after each update.

Which WordPress version contains the fix?

The source data for this advisory does not list a fixed version number. Check the linked WordPress release announcement and the NVD entry for the authoritative fixed release, then update to the latest available version.

Sources: WordPress release announcement, Wordfence threat intelligence, NVD entry for CVE-2026-119977, and CISA Known Exploited Vulnerabilities Catalog.