WordPress Core Remote Code Execution (RCE) Vulnerability Alert (CVE-2026-119977)

1. Immediate Core Update Update your WordPress installation to version 7.1.4 or higher immediately via the dashboard or WP-CLI.

# Update via WP-CLI
wp core update

2. Web Application Firewall (WAF) Configuration Implement WAF rules to block direct access to PHP files within the upgrade directory. For Apache (.htaccess):

<Directory "/wp-content/upgrade">
    <FilesMatch "\.php$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</Directory>

3. Hardening Staging Paths Ensure that the `wp-content/upgrade` directory is not indexable and that file permissions are strictly set to prevent unauthorized writes outside of the official update process.

This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) within the WordPress core update mechanism. During a full-package upgrade, WordPress extracts files into a predictable, web-accessible staging directory under wp-content/upgrade/. An attacker can predict this path and inject malicious scripts during the upgrade window. When the process completes and moves the staged files to the production root, the malicious payload is deployed and executed. With a high EPSS score of 0.94 and its inclusion in the CISA KEV catalog, this vulnerability is actively being exploited in the wild to compromise WordPress sites.