WordPress Core Fix for CVE-2026-119977 Can Itself Briefly Expose Sites During Installation

Scope: WordPress Core, versions 4.7 through 7.1.3, including sites in the process of applying the official fix

Severity: Amber

New research published this week adds an important wrinkle to the WordPress Core flaw we flagged last week, CVE-2026-119977, the race condition exploitable during a full core upgrade. The official fix for the vulnerability does not avoid the problem it is meant to solve: WordPress’s own updater code unpacks the update package using the site’s existing, still-unpatched code before the new files are in place, which means a copy of the vulnerable WordPress installer remains reachable over the web during the update process itself, including while a site administrator is in the middle of installing the fix. An attacker who strikes at the right moment during that window can still overwrite a real site file and gain the ability to read or write files on the live WordPress installation, effectively defeating the purpose of patching in that single moment. Researchers observed sustained scanning activity, with some sources checking small groups of sites for roughly 14.5 hours at a stretch, consistent with attackers specifically waiting to catch sites in the act of updating rather than targeting already-patched or already-vulnerable sites directly. Administrators applying the fix for CVE-2026-119977 should block web access to the site’s wp-content/upgrade folder before initiating the update, complete the update, and only then restore normal access; anyone who already applied the update without taking this precaution should check that folder and the surrounding site files for anything unexpected.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.