Low Severity
CVE-2026-119977
Published: Nov 4, 2026
Detection-only local triage scanner for CVE-2026-119977 (CISA KEV 2026-11-03) in WordPress Core: grades versions 4.7-7.1.3 against per-branch fixes (7.1.4 and backports) and flags wp-content/upgrade exposure. No payloads, no remote probing.
# `wordpress-core-scanner`
Local triage for `CVE-2026-119977`, the unauthenticated upgrade-window race in `WordPress Core`. Give it a `WordPress` version you own, or a `version.php` file you own, and it tells you whether that install is still open. It never touches the network, never probes a server, never starts an update, never tries to win the race.
## `The flaw`
During a full-package core update, `WordPress` unpacked the new files into a predictable, web-accessible staging directory under `wp-content/upgrade/`. The staged copy includes the installer. An unauthenticated attacker who reached that staged installer in the seconds-long window between unpacking and cleanup could execute code on the server. That is `CWE-367`, a time-of-check to time-of-use race: a check observes a state, the state changes, and a later operation uses the changed state.
`WordPress 7.1.4`, released `28 October 2026`, fixes it by randomizing the staging directory name, adding an index guard, and stopping staged configuration data from being promoted unsafely. The fix is backported to every branch back to `4.7`. `Wordfence`, the `CNA` that assigned the `CVE`, scores it `CVSS 3.1 8.1 High` (`AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`). `Wordfence` blocked tens of thousands of attempts in the first days, and `CISA` added the flaw to its `Known Exploited Vulnerabilities` catalog on `3 November 2026`, with a federal fix deadline of `6 November 2026`. No confirmed site takeover has been reported. Attempts are not compromises, and this tool grades exposure, not compromise.
## `What it checks`
- `A version you supply` (`--version 7.1.3`): graded against the fixed release for its branch
- `A version file you supply` (`--version-file wp-includes/version.php`): `$wp_version` parsed out of a file you own
- `An install root you supply` (`--wp-root /var/www/html`): `wp-includes/version.php` graded, plus a note if `wp-content/upgrade/` still exists on disk under that install
- `An offline inventory` (`--