WordPress Core Updater Race Condition Enables Unauthenticated RCE Even After Patching
Written by AI from the linked story. Not reviewed by an editor. How this works
A race condition flaw (CVE-2026-119977) lurking in WordPress's core update mechanism since version 2.7 allows unauthenticated attackers to inject and execute PHP code during the update unpacking process — meaning the act of patching itself can be exploited. Even sites that have upgraded to the fixed version 7.1.4 may remain exposed if the update process was initiated from certain older versions. This matters because CISA has confirmed active exploitation, turning a routine maintenance task into an attack vector. Organizations relying solely on 'apply the latest update' as their security strategy are reminded that patch integrity and delivery mechanisms must themselves be hardened.
Tactical Insight
Immediate actions
- Temporarily disable public-facing WordPress update triggers and apply the 7.1.4 patch via a controlled, offline or staging-first deployment process to avoid exploitation during unpacking.
- Audit all WordPress instances in your environment to confirm whether they transitioned through a vulnerable intermediate version during the update path.
- Apply Web Application Firewall (WAF) rules to block unauthenticated POST requests to WordPress core update endpoints while patching is in progress.
Long-term improvements
- Implement a formal patch validation process that tests update delivery mechanisms — not just the patch content — in isolated environments before production rollout.
- Maintain an accurate, continuously updated inventory of all CMS versions and plugins across your web estate to enable rapid response to actively exploited CVEs.
- Enforce the principle of least privilege on web server processes so that even successful PHP code execution cannot escalate to full system compromise.
Detection measures
- Deploy file integrity monitoring (FIM) on WordPress core directories to alert on unexpected file writes during or after the update process.
- Enable centralized logging of web server events and alert on anomalous PHP execution patterns, especially those originating from the update unpacker path.