The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress core vulnerability to the Known Exploited Vulnerabilities catalog. CISA urges users to patch the vulnerability before November 6, 2026.
Tracked as CVE-2026-119977, the vulnerability in WordPress Core may allow an attacker to execute arbitrary code on affected servers.
Vulnerability Details
This is a time-of-check time-of-use (TOCTOU) race condition vulnerability that arises from the predictable, web-accessible staging paths used during full-package core upgrades.
Last week, Wordfence reported that the vulnerability can be exploited without requiring an authenticated user account. However, successful exploitation is only possible during a short window when a complete WordPress Core update is in progress, which can enable unauthenticated remote code execution.
According to Wordfence, more than 18,500 requests targeting staged setup-config.php installer paths were observed in the first 21 hours after the vulnerability’s public disclosure. At the time of reporting, the company had blocked 12,632 exploitation attempts against the flaw over the preceding 24-hour period.
Affected Versions
- 7.0.0 – 7.0.7
- 7.1.0 – 7.1.3
- 4.7.0 – 4.7.38
- 4.8.0 – 4.8.33
- 4.9.0 – 4.9.34
- 5.0.0 – 5.0.30
- 5.1.0 – 5.1.27
- 5.2.0 – 5.2.29
- 5.3.0 – 5.3.26
- 5.4.0 – 5.4.24
- 5.5.0 – 5.5.23
- 5.6.0 – 5.6.22
- 5.7.0 – 5.7.20
- 5.8.0 – 5.8.18
- 5.9.0 – 5.9.19
- 6.0.0 – 6.0.17
- 6.1.0 – 6.1.15
- 6.2.0 – 6.2.14
- 6.3.0 – 6.3.13
- 6.4.0 – 6.4.13
- 6.5.0 – 6.5.13
- 6.6.0 – 6.6.10
- 6.7.0 – 6.7.10
- 6.8.0 – 6.8.11
- 6.9.0 – 6.9.10
Mitigation
Users can update to one of the following versions, or a newer patched version, to patch the vulnerability:
- 4.7.39
- 4.8.34
- 4.9.35
- 5.0.31
- 5.1.28
- 5.2.30
- 5.3.27
- 5.4.25
- 5.5.24
- 5.6.23
- 5.7.21
- 5.8.19
- 5.9.20
- 6.0.18
- 6.1.16
- 6.2.15
- 6.3.14
- 6.4.14
- 6.5.14
- 6.6.11
- 6.7.11
- 6.8.12
- 6.9.11
- 7.0.8
- 7.1.4
For more information, please refer to the WordPress Security Advisory.
Qualys Detection
Qualys customers can scan their devices with QID 735969 to detect vulnerable assets.
Continue to follow Qualys Threat Protection for more coverage on the latest vulnerabilities.
