CVE-2026-119977 has emerged as a significant security flaw that permits cybercriminals to commandeer WordPress sites during essential core updates.
The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the ongoing exploitation of this vulnerability, urging users to implement timely patches to safeguard their systems.
CISA has issued a stark warning regarding the exploitation of a core vulnerability in WordPress, identified as CVE-2026-119977, which can enable unauthorized access during website updates.
This flaw pertains to the updater’s management of temporary installation files, potentially allowing for remote code execution without necessitating an account on the target site.
Umut Bayram, a security investigator at Picus Security, uncovered this vulnerability, which holds a CVSS score of 8.1. Notably, this issue was cataloged in CISA’s Known Exploited Vulnerabilities database on November 3.
Despite its recent disclosure, Bayram traced the problematic behavior back to WordPress version 2.7, which was released in 2008.
Public advisories indicate that versions from 4.7 to 7.1.3 are vulnerable, and his research suggests that older versions are also at risk.
The feasibility of exploiting a specific installation hinges on its update package, server configuration, and the attacker’s ability to locate temporary files.
How an Update Can Expose a Website
During the core update process, WordPress temporarily extracts downloaded files into a designated directory located at wp-content/upgrade/ prior to integrating them into the live installation.
If the update package contains the WordPress installer and the server permits web access along with PHP execution in that directory, attackers could access a temporary version of WordPress during the update procedure.
Notably, the temporary installer searches for nearby locations to find an existing configuration file but fails to identify the live site’s wp-config.php. Consequently, it treats the extracted version as an installation that has yet to be configured.
An intruder who acts swiftly could provide the connection details for a database they control. In such a scenario, the installer would create a new wp-config.php within the temporary directory.
In vulnerable versions, the updater might inadvertently overwrite the live site’s configuration with the attacker-generated file.
This would redirect WordPress to the intruder’s database, facilitating the creation of an administrator account.
For typical single-site installations allowing administrator-level users to install plugins, this could lead to executing PHP code on the server.
Bayram elucidates this attack sequence in his technical analysis. The success of the attack hinges on a time-of-check time-of-use race condition, implying that an attacker must act between the stages of an update, before WordPress purges the temporary installation.
Not every update exposes the requisite files. Furthermore, the attacker must ascertain the staging directory’s location.
Some earlier releases featured an element of randomness in that path, complicating the exploitation process and necessitating alternative methods to uncover its name.
WordPress Has Released Fixes
In response to this alarming vulnerability, WordPress launched version 7.1.4 on October 28, which implements a fix to thwart the vulnerability.
This update randomizes temporary directory names, retains a protective file to prevent directory listings, and ensures that a staged wp-config.php cannot overwrite the live configuration.
The security updates have also been backported to older iterations, down to version 4.7. However, WordPress cautions that only its latest version is under active support. Releases from versions 2.7 to 4.6 remain unpatched and should be upgraded accordingly.
For federal systems within its jurisdiction, CISA designated November 6 as the deadline for remediation and has mandated forensic triage in compliance with Binding Operational Directive 26-04.
The advisory regarding exploitation does not disclose the identity of the attackers or the number of compromised websites.
The First Patched Update Still Needs Protection
Implementing the patch necessitates extra precautions since the extraction process occurs through the pre-existing updater on the website.
When an unpatched site upgrades to a fixed release, the new code effectively stops the temporary configuration file from overwriting the live one.
Nevertheless, the legacy extraction code may still leave a temporary installer accessible at a predictable web location.
Consequently, an attacker might configure that temporary installation and execute PHP code prior to WordPress completing its cleanup process.
Code executed in this scenario would operate with the web server’s permissions, potentially granting access to live site files.
To mitigate this risk, Bayram advises restricting web access to wp-content/upgrade/ before initiating the update, confirming that any requests to this directory yield a 403 response.
Such restrictions should be enforced through server configurations or the WordPress root .htaccess file, rather than within the upgrade directory itself, where the updater could remove them.
Alternatively, administrators might download and extract the patched release outside the publicly accessible web directory, subsequently replacing core files while safeguarding wp-config.php and wp-content.
It is essential to note that a standard wp core update command does not suffice, as it employs the same core updater.
Research Took About Four Hours With AI Assistance
Bayram disclosed that he uncovered the vulnerability utilizing GPT-5.6 Sol as an aid, spending approximately four hours from initial examination of the updater to the creation of a functional exploit chain.
In remarks shared with Hackread.com, he cautioned that quicker vulnerability research inherently presents attackers with increased opportunities to identify weaknesses in widely utilized software.
“If an early-career researcher can uncover a two-decade-old RCE in a single afternoon, so too can an attacker,” Bayram asserted.
He also emphasized the delays in deploying production updates, leaving organizations vulnerable even post-patch release.
“There remains a gap wherein you are exposed, and that is precisely when attackers are most active,” Bayram articulated.
He urged organizations to validate their security defenses proactively whenever system alterations occur, rather than postponing assessments until routine testing schedules.
“That is the pivotal moment, and it’s crucial to ascertain whether you are exploitable and whether your defenses can withstand an assault,” he concluded.
Source link: Hackread.com.
