Critical Severity
CVE-2026-119977
Published: Nov 6, 2026
CVE-2026-119977 – WordPress Core Upgrade-Window RCE (CVSS 8.1) | Red/Blue Team Toolkit. Predictable staging dir takeover, wp-config.php promotion, Bait MySQL proof, WAF origin discovery, rate-limited race oracle, admin shell deploy, version triage. Async, CI-tested. Only ethical & authorized use, stay legal.
# CVE-2026-119977 – WordPress Core Upgrade-Window RCE Toolkit
[](https://github.com/tc4dy/CVE-2026-119977-Toolkit/actions/workflows/ci.yml)
[](https://www.python.org/downloads/)
[](https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator)
[](https://github.com/tc4dy/CVE-2026-119977-PoC-Exploit)
[](https://github.com/tc4dy/CVE-2026-119977-PoC-Exploit)
[](https://github.com/tc4dy/CVE-2026-119977-PoC-Exploit)
> **Ethical Use Only – Authorized Tested**
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.**
---
## [*] Vulnerability Overview
**CVE-2026-119977** is a use-after-free in the Linux kernel's IPv4 TCP stack... no, wait. It is a TOCTOU race condition in WordPress Core versions 4.7.0 through 7.1.3. During a full-package core update, WordPress unpacks the new release into a predictable, web-accessible staging directory under `wp-content/upgrade/`. Because `update_core()` does not skip `wp-config.php` when copying the staged tree to the live root, an unauthenticated attacker who reaches the staged installer inside the update window can plant an attacker-controlled `wp-config.php` that replaces the live one.
### How it works
1. **Predictable staging directory** – `WP_Upgrader::unpack_package()` derives the working directory from the package basename, which is `wordpress-<version>`.
2. **Staged installer reachable** – the sta