CVE-2026-119977 with a CVSS score of 8.1 is a time-of-check, time-of-use race condition in WordPress Core versions 4.7 through 7.1.3, affecting the upgrade process and temporary staging files beneath wp-content/upgrade. During a full WordPress Core upgrade, the software extracts a complete upgrade package and places files in a staging directory. On affected setups, those files can be reached through the web while the server is still completing the update, briefly exposing a separate copy of the WordPress installer. An attacker does not need a valid account or user interaction, but must reach the temporary installer before cleanup finishes. By doing so, the attacker can use the installer to connect the staged installation to a database they control, creating a path toward server code execution. The business impact includes unauthorized malicious code execution on website servers, potential compromise of sensitive data, disruption of web services, loss of customer trust, and increased operational costs. Because exploitation depends on a short upgrade window, repeated requests can help an attacker catch that window, although such requests alone do not prove a successful breach. The flaw is therefore a high-severity remote code execution risk for organizations operating affected WordPress Core installations.
We recommend you to refer this link: https://wordpress.org/news/2026/10/wordpress-7-1-4/[/subscribe_to_unlock_form]
CVE-2026-119977 with a CVSS score of 8.1 is a time-of-check, time-of-use race condition in WordPress Core versions 4.7 through 7.1.3, affecting the upgrade process and temporary staging files beneath wp-content/upgrade. During a full WordPress Core upgrade, the software extracts a complete upgrade package and places files in a staging directory. On affected setups, those files can be reached through the web while the server is still completing the update, briefly exposing a separate copy of the WordPress installer. An attacker does not need a valid account or user interaction, but must reach the temporary installer before cleanup finishes. By doing so, the attacker can use the installer to connect the staged installation to a database they control, creating a path toward server code execution. The business impact includes unauthorized malicious code execution on website servers, potential compromise of sensitive data, disruption of web services, loss of customer trust, and increased operational costs. Because exploitation depends on a short upgrade window, repeated requests can help an attacker catch that window, although such requests alone do not prove a successful breach. The flaw is therefore a high-severity remote code execution risk for organizations operating affected WordPress Core installations.
We recommend you to refer this link: https://wordpress.org/news/2026/10/wordpress-7-1-4/[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]