CVE-2026-119977

A vulnerability in WordPress (CVE-2026-119977) affecting versions 4.7 through 7.1.3 allows unauthenticated attackers to execute code on servers during the update process. The flaw arises because the updater uses old, unpatched code to unpack new versions into a predictable temporary folder under wp-content/upgrade, which can be accessed before deletion. Attackers can exploit this brief window to run malicious PHP code, modify configuration files, or gain access to the live site. The U.S. CISA has confirmed active exploitation, and exploit code has appeared in public GitHub repositories.