CVE-2026-119977: WordPress 7.1.4 Update Can Still Expose RCE
WordPress 7.1.4 update can still expose RCE due to race condition.
A race condition vulnerability (CVE-2026-119977) in WordPress's core updater, present since version 2.7, can allow unauthenticated attackers to execute PHP code on a server. While WordPress released a fix in version 7.1.4, older sites updating to this version may still be vulnerable due to how the update unpacks. CISA has listed this flaw as actively exploited.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CISA?
Get an email when a new story names CISA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA race condition flaw (CVE-2026-119977) lurking in WordPress's core update mechanism since version 2.7 allows unauthenticated attackers to inject and execute PHP code during the update unpacking process — meaning the act of patching itself can be exploited. Even sites that have upgraded to the fixed version 7.1.4 may remain exposed if the update process was initiated from certain older versions. This matters because CISA has confirmed active exploitation, turning a routine maintenance task into an attack vector. Organizations relying solely on 'apply the latest update' as their security strategy are reminded that patch integrity and delivery mechanisms must themselves be hardened.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-119977