{"id":12388,"date":"2026-11-03T15:25:27","date_gmt":"2026-11-03T21:25:27","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-138-active-exploitation-of-critical-flaw-in-wordpress-core-during-upgrade\/"},"modified":"2026-11-03T15:42:08","modified_gmt":"2026-11-03T21:42:08","slug":"alert-2026-138-active-exploitation-of-critical-wordpress-core-flaw-during-updates","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-138-active-exploitation-of-critical-wordpress-core-flaw-during-updates\/","title":{"rendered":"Alert 2026-138 Active exploitation of critical WordPress Core flaw during updates"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
WordPress 7.1<\/strong><\/td>7.1.0 to 7.1.3<\/td><\/tr>
WordPress 7.0<\/strong><\/td>7.0.0 to 7.0.7<\/td><\/tr>
WordPress 6.9<\/strong><\/td>6.9.0 to 6.9.10<\/td><\/tr>
WordPress 6.8<\/strong><\/td>6.8.0 to 6.8.11<\/td><\/tr>
WordPress 4.7 to 6.7<\/strong><\/td>All versions prior to the fixed version of each branch<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

WordPress 4.6 and earlier do not receive a fix because they are out of support.<\/p>\n\n

Description<\/h2>\n\n

A vulnerability has been disclosed in WordPress Core that allows a remote unauthenticated attacker to execute PHP code on the server during a core upgrade. The vulnerability has been tagged as CVE-2026-119977 (CVSSv3.1 8.1 – HIGH) and is of the time-of-check to time-of-use (TOCTOU, CWE-367) race condition type. Due to confirmed active exploitation and the widespread installed base, it is classified as CRITICAL severity.<\/p>\n\n

During a core upgrade that uses the full package, affected versions extract the new files into a predictably named directory inside wp-content\/upgrade\/<\/code>, which is published by the web server. Researchers point out that this temporary copy includes the installer (wp-admin\/setup-config.php<\/code>), which starts without the site configuration. An attacker who wins the race against the extraction can execute PHP code with the privileges of the web process.<\/p>\n\n

Researchers point out that exploitation requires a core upgrade to be performed with the full package, web access and PHP execution enabled in wp-content\/upgrade\/<\/code>, the temporary path to be predictable or discoverable, and the attack to complete before WordPress deletes the temporary files. In the lab the window lasts only seconds, but repeated automated probing increases the chances of success, and the window recurs on every upgrade, including automatic ones. The vendor indicated that WordPress 7.1.4 and the fixed versions of earlier branches, down to 4.7, resolve the issue.<\/p>\n\n

The vendor rates the flaw as low severity due to the narrow exploitation window, while the published CVSS score is 8.1. However, the vulnerability was added on Nov 3, 2026 to known exploited vulnerability catalogs, and a European government cybersecurity agency issued an advisory flagging it as actively exploited. Public sources report massive attempts and automated probing since Oct 28, 2026, with no public details of successful compromises. No public proof of concept or association with ransomware campaigns is known.<\/p>\n\n

An application firewall implemented as a WordPress plugin does not protect against this vulnerability, because the extracted copy loads WordPress from its own files and the site’s plugins do not run in that request.<\/p>\n\n

Mitigation<\/h2>\n\n

Before upgrading, it is recommended to:<\/p>\n\n