[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f95SMpGRxDrzdAD6WgMf9GtA8D0O98K_a_ZMlJjwJH9E":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":116},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"3813477b-1817-4eb5-af60-62bb07849fe1","CVE-2026-119977: WordPress 7.1.4 Update Can Still Expose RCE","cve-2026-119977-wordpress-7-1-4-update-can-still-expose-rce-557df7","Xint says the old updater still unpacks the 7.1.4 fix on unpatched sites, leaving a window for code execution as CISA lists the flaw as exploited.","A race condition vulnerability (CVE-2026-119977) in WordPress's core updater, present since version 2.7, can allow unauthenticated attackers to execute PHP code on a server. While WordPress released a fix in version 7.1.4, older sites updating to this version may still be vulnerable due to how the update unpacks. CISA has listed this flaw as actively exploited.","WordPress 7.1.4 update can still expose RCE due to race condition.","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fcve-2026-119977-wordpress-core-update-race-rce.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fwordpress-update.webp","2026-11-04T16:56:52+00:00","2026-11-04T18:00:18.584394+00:00",9,[17,20,23],{"name":18,"type":19},"WordPress","product",{"name":21,"type":22},"CISA","vendor",{"name":24,"type":25},"PHP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"cve","CVE-2026-119977","WordPress core updater race condition vulnerability",[21,18],{"controls":51,"vendors":109},[52,81],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,101],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":82,"product_name":98,"url":99,"description":100},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[110],{"slug":111,"name":112,"logo_path":113,"roles":114},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png",[115],"reported_by",{"slug":117,"title":118,"body":119,"framework_refs":120,"framework_notes":128},"wordpress-core-updater-race-condition-enables-unauthenticated-rce-even-after-patching","WordPress Core Updater Race Condition Enables Unauthenticated RCE Even After Patching","A race condition flaw (CVE-2026-119977) lurking in WordPress's core update mechanism since version 2.7 allows unauthenticated attackers to inject and execute PHP code during the update unpacking process — meaning the act of patching itself can be exploited. Even sites that have upgraded to the fixed version 7.1.4 may remain exposed if the update process was initiated from certain older versions. This matters because CISA has confirmed active exploitation, turning a routine maintenance task into an attack vector. Organizations relying solely on 'apply the latest update' as their security strategy are reminded that patch integrity and delivery mechanisms must themselves be hardened.",[121,122,123,124,125,126,127],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":129,"PCI DSS Requirement 6":130,"NIST SP 800-53 SI-2: Flaw Remediation":131,"OWASP A06:2021 Vulnerable and Outdated Components":132,"CIS Control 7: Continuous Vulnerability Management":133,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":134,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":135},"NIS2 requires entities to implement incident handling and vulnerability management practices; the active exploitation status confirmed by CISA obligates in-scope organisations to treat this as an urgent risk requiring immediate remediation and incident readiness.","PCI DSS Requirement 6 mandates that organisations develop and maintain secure systems by applying security patches promptly and ensuring the patch process itself does not introduce risk — directly applicable where WordPress handles any payment-adjacent web content.","SI-2 requires organisations to identify, report, and correct information system flaws — critically including verifying that the patch delivery and installation process is itself secure, which this race condition violates.","Sites running any WordPress version older than 7.1.4 (or those that updated through a vulnerable path) represent exactly the outdated component risk OWASP A06 warns against, especially where CMS inventories are not actively maintained.","This flaw has existed since WordPress 2.7 and is now actively exploited; a continuous vulnerability management programme with tracked CVE remediation deadlines would have identified and prioritised this long-standing risk before CISA listed it as exploited.","A.8.8 mandates timely identification and remediation of technical vulnerabilities; the 15+ year presence of this flaw in WordPress core indicates that vulnerability management processes failed to surface or prioritise it until active exploitation forced the issue.","The vulnerability allows unauthenticated attackers to execute PHP code, highlighting a failure to enforce authentication controls around sensitive core update mechanisms — a gap PR.AA controls are designed to prevent."]