WordPress Core Flaw Exploited During the Software Upgrade Process Itself (CVE-2026-119977)

Scope: WordPress Core, patched versions released late October 2026

Severity: Red

CISA confirmed active exploitation of CVE-2026-119977 on November 4, 2026, adding it to its Known Exploited Vulnerabilities catalog with a federal deadline of Friday, November 6. The flaw is a time-of-check time-of-use race condition, meaning the vulnerable window is not a permanent gap in the software but a narrow moment during a full WordPress core upgrade, when the upgrade process uses predictable, web-accessible staging paths to stage new files before installing them. Security researcher Umut Bayram of Picus Security reported the issue, and WordPress security firm Wordfence confirmed that exploiting it requires no account on the site at all, only the ability to catch that brief window during a complete core update to achieve unauthenticated code execution. This is an unusual kind of flaw to defend against precisely because the exposure is time-limited rather than constant, which means standard vulnerability scanning that checks a site’s current state may not catch it. Given WordPress’s dominant share of websites across Uganda’s government, education, and business sectors, the scale of potential exposure is significant even though each individual exposure window is brief. Organisations running WordPress must apply the patch released late last month today if this has not already happened, and should be cautious about triggering a full core upgrade on a high-value site without monitoring the process, since the vulnerable window occurs during that exact operation.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.