Attackers exploit WordPress upgrade race to run code on servers without logging in

What happened

Attackers are abusing a flaw in how WordPress handles full-package core upgrades. During such an upgrade, WordPress stages files in locations that are easy to guess and reachable from the web. An attacker who needs no login can use that brief window to run their own code on the server.

The problem is a race condition. The attack only works while an upgrade is in progress, so the attacker has to hit the right moment. CISA added the flaw, tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities catalog on 3 November 2026. The Dutch NCSC has also published an advisory, NCSC-2026-0466.

Who is affected

Sites running WordPress core from version 4.7 through 7.1.3 are affected. WordPress fixed the flaw in a new release for each maintained branch: 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8 and 7.1.4. Any site on an older release within one of those branches is exposed.

How serious is it

The flaw carries a CVSS score of 8.1, rated high. A successful attack gives an outsider code execution on the web server, which puts the site's data and the server itself at risk. The score is held back from critical only because the attacker has to time the attack to coincide with an upgrade. That hurdle has not stopped real attacks: CISA confirms the flaw is being exploited and has told US federal agencies to act by 6 November 2026.

What you should do

1. 1Update WordPress to the fixed release for your branch, or to 7.1.4 on the current branch.
2. 2Check that sites relying on automatic updates have actually moved to a fixed release.
3. 3Follow the vendor instructions referenced in CISA's required action and the NCSC advisory NCSC-2026-0466.

Quick facts