WordPress Core CVE-2026-119977

Exploitation is only possible while the target is performing a full-package WordPress core upgrade; the flaw is the use of predictable, web-accessible staging paths during that upgrade, so the attacker must reach those paths over HTTP and act within the transient upgrade window (a TOCTOU race, CWE-367, reflected in AC:H). No authentication is required (PR:N) and no user interaction (UI:N). The principal limiting factors are therefore timing (the site must be actively upgrading core, which is intermittent) and the need to win the race against the upgrader; outside an active upgrade window the condition is not present. Affected versions are WordPress Core 4.7 through 7.1.3; sites on 7.1.4 or later are not affected.

This is a genuine high-priority issue but not a drop-everything emergency, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes an unauthenticated, network-reachable path to full code execution, which aligns with the description of unauthenticated RCE via predictable, web-accessible staging paths. The single tempering factor is AC:H, which matches CWE-367 (TOCTOU race condition): exploitation is only possible during the transient core-upgrade window, a condition that is largely outside the attacker's control, so successful exploitation requires winning a race rather than simply sending one request. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the supplied data, so there is no evidence of active exploitation - absence of these signals is not proof of safety, but it means urgency rests on the Wordfence disclosure and the vuln.today 'this_week' decision label rather than on observed in-the-wild use. Given the ubiquity of WordPress and the unauthenticated full-RCE outcome, the AC:H race window is the main thing standing between this and a critical-rated mass-exploitation bug; treat it as a prompt patch (this week) rather than an emergency, consistent with the decision label.

While a WordPress site is performing a full-package core upgrade, an unauthenticated remote attacker who has predicted the web-accessible staging path races to place or substitute code in that staging directory before the upgrader finalizes it, causing attacker-controlled code to execute on the server. Because the staging paths are predictable and reachable over HTTP, the attacker needs no credentials, but they must hit the narrow upgrade window (reflected in AC:H). No confirmed working exploit code is present in the supplied data.