An update to my WordPress core RCE post.
What’s new
- It now has an ID: CVE-2026-119977, a time-of-check/time-of-use race reported by Picus Security’s Umut Bayram
- CISA added it to KEV on Tuesday and told federal agencies to patch by Friday, and it urged everyone else to patch too
- Wordfence said it blocked 13,095 attacks on it in a 24-hour period over the weekend
Recap: unauthenticated code execution during the upgrade window through predictable, web-accessible staging paths in full-package core upgrades. Fixed in 7.1.4.
My take
If you’re not on 7.1.4, do it now, and check logs for PHP requests under wp-content/upgrade. My WP-CLI how-to walks through it.
God Bless, and Use the Source!
