CVE-2026-119977: WordPress Core Unauthenticated RCE

How to Detect CVE-2026-119977 Exploitation

Detection should focus on vulnerable WordPress versions, update activity, requests to upgrade staging locations, and unexpected changes made during or immediately after a core upgrade.

Begin by inventorying all internet-facing WordPress installations. Record:

• Exact WordPress Core version
• Update method
• Web server
• PHP handler
• Filesystem location of wp-content/upgrade
• Whether the staging directory is publicly reachable
• Whether PHP execution is possible under the staging directory

Review Web-Server Logs

Review access logs around every WordPress update performed while the site was running an affected version. Look for requests involving:

• wp-content/upgrade
• Temporary package directories
• PHP files in staging locations
• Unexpected query strings
• Successful responses from paths that should not be publicly served

A generic web-server search can identify obvious staging-path access:

zgrep -hEi \
  '/wp-content/upgrade|/wp-admin/.+upgrade|/upgrade/.+\.php|/wp-content/upgrade/.+\.php' \
  /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null

For an Elastic-style environment, a starting query might be:

url.path : "/wp-content/upgrade/*" OR
url.path : "*upgrade*.php" OR
url.path : "/wp-admin/*upgrade*"

Adapt field names and path patterns to the local logging schema. A request alone is not proof of exploitation, but requests to staging PHP files during an update should be escalated, especially when associated with:

• 200 or 3xx responses
• Unusual user agents
• Repeated probing
• Subsequent access to administrative endpoints
• Upload or plugin-installation activity
• Suspicious outbound connections

Check the Host Filesystem

Identify PHP files created or modified under upgrade-related directories and compare them with expected package contents:

find /var/www/example.com -path '*/wp-content/upgrade/*' \
  -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) \
  -printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' 2>/dev/null

Also investigate:

• Unexpected administrator accounts
• Modified wp-config.php
• New plugins or themes
• Altered scheduled tasks
• Web shells
• Modified .htaccess or web-server configuration
• Unexpected PHP processes
• Outbound connections from the web process

Preserve logs and filesystem metadata before cleanup if compromise is suspected.

Mitigation and Patching

The primary WordPress security update is to upgrade immediately to 7.1.4. Administrators on older supported branches should deploy the corresponding fixed release listed above, such as 6.9.11, 6.8.12, 6.5.14, or 4.7.39.

Confirm the resulting version after the update and retain package-manager, deployment, or WordPress update logs as evidence.

Updating with WP-CLI

For a command-line deployment using WP-CLI, verify the current version, create an appropriate backup, and update WordPress Core:

cd /var/www/example.com

wp core version
wp db export /var/backups/example-com-$(date +%F-%H%M%S).sql
wp core update
wp core version

wp core update selects the current release available to the installation’s update channel. In controlled environments, use the organization’s approved artifact and deployment process, then verify that it is one of the fixed versions.

Do not assume that a successful command means the site is remediated until the installed version has been checked.

Block Public Access to Upgrade Staging Paths

Temporary defenses should reduce exposure while patching is scheduled. Deny direct web access to upgrade staging content and prevent PHP execution beneath the staging directory.

For Apache, a directory-level rule can deny access and disable PHP handling, subject to local configuration and version compatibility:

# Apply within the WordPress wp-content/upgrade directory
Require all denied

<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

For Nginx, block the path at the server or location level and ensure PHP requests cannot be passed to the PHP-FPM upstream:

location ^~ /wp-content/upgrade/ {
    deny all;
    return 403;
}

These controls are defense-in-depth, not substitutes for installing a fixed WordPress release. Validate them against the site’s update workflow because an overly broad rule may interfere with legitimate administrative operations.

Also ensure that staging directories are not writable or executable in ways that allow a web process to create persistent PHP content.

What to Do If Compromise Is Suspected

If a vulnerable site was internet-facing and performed a full-package update before remediation, treat it as potentially compromised until the investigation establishes otherwise.

After patching:

1. Preserve relevant logs, filesystem metadata, and forensic evidence.
2. Review requests to staging paths during update windows.
3. Check for unexpected files, administrator accounts, plugins, and themes.
4. Inspect scheduled tasks and web-server configuration.
5. Compare WordPress Core files with a known-good release.
6. Rotate WordPress administrator credentials.
7. Rotate database, hosting-panel, deployment, and API credentials if exposure is possible.
8. Review outbound traffic from the web server.
9. Rebuild the host if integrity cannot be established.
10. Document the timeline, indicators, remediation, and validation steps.

Do not delete suspicious files before preserving evidence. Removing a web shell may eliminate useful indicators while leaving other persistence mechanisms undiscovered.

References

1. NVD: CVE-2026-119977
2. CISA Known Exploited Vulnerabilities Catalog
3. WordPress 7.1.4 security release
4. WordPress 7.1.3 class-core-upgrader.php reference
5. WordPress 7.1.3 class-wp-upgrader.php reference
6. WordPress 7.1.3 update-core.php reference
7. WordPress 7.1.3 setup-config.php reference
8. WordPress 7.1.4 upgrader reference
9. Trend Micro security alert
10. Technical exploitation and remediation discussion

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.