CISAAnalysisCISA adds WordPress Core race condition RCE to Known Exploited Vulnerabilities catalog
What happened.The Cybersecurity and Infrastructure Security Agency added WordPress Core race condition vulnerability CVE-2026-119977 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild.
Why it matters.Content management platforms power critical enterprise documentation portals, web applications, and customer hubs. When core updater workflows expose temporary directories to unauthenticated remote attackers, perimeter controls fail during routine maintenance operations. Infrastructure engineers must verify that production sites run WordPress 7.1.4 or patched security backports immediately. Platform teams should restrict public web access to upgrade staging directories to stop automated exploitation scripts.
The technical specifications:
- Race condition mechanics: Tracked as CVE-2026-119977, the flaw affects WordPress Core versions 4.7.0 through 7.1.3 when the platform creates temporary staging folders during full-package core software upgrades.
- Exploitation vector: Remote unauthenticated actors target predictable web-accessible staging paths during the upgrade extraction window to write and execute arbitrary PHP code.
- Federal directive: CISA issued a mandatory three-day compliance deadline under Binding Operational Directive 26-04, requiring federal civilian agencies to upgrade environments to WordPress 7.1.4 by November 6, 2026.