CVE-2026-119977 Unauthenticated Remote Code Execution Through the Core Upgrade Staging Directory

CVE-2026-119977 is a high-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks WordPress sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-119977?

Detects WordPress sites that expose a complete, unconfigured copy of WordPress while they are updating themselves. To install a core update, WordPress unpacks the release archive into wp-content/upgrade and then copies it over the live site. That staging directory is served to the web like any other file under wp-content, and the copy inside it has no wp-config.php of its own, so for the length of the upgrade its wp-admin/setup-config.php is a live installer that any anonymous visitor can submit database settings to. Up to 7.1.3 the staging directory took its name from the package filename and wp-content/upgrade held no index.php, so on a server with directory listing enabled a single request to wp-content/upgrade reads the name straight out of the index. The second half of the bug is the copy step: the list of files the upgrade refuses to overwrite did not include wp-config.php, so a configuration file an attacker wrote into the staging directory is copied into the web root and its PHP then runs on every request to the site. The check reads the staging directory name out of the listing, confirms the staged copy answers with WordPress's database configuration form, confirms the site's own installer is closed so this can only be a second copy exposed by the upgrade, and then posts configuration values that the staged installer validates server side. The posted table prefix is deliberately invalid, which WordPress rejects before it opens a database connection and before it writes anything, so no file is created. CVSS 8.1 and listed by CISA as known exploited. Upgrade to WordPress 7.1.4 or the patched release on your branch, backported as far as 4.7.39, which adds sixteen random characters to the staging directory name, puts an index.php in wp-content/upgrade, and never copies a wp-config.php out of it.