Originally published on Sitecheckly.

CVE-2026-119977 is a WordPress core race condition that can allow unauthenticated attackers to execute code on the server during a full-package upgrade. CISA reports evidence of exploitation in the wild. WordPress was detected on 12% of the sites analyzed in Sitecheckly’s survey, but that figure does not measure exposure to this flaw. Check your installed core version, then consult the NVD vulnerability record for affected versions and the WordPress vendor advisory for the fix.

What is CVE-2026-119977, and which WordPress versions are affected?

The CVE-2026-119977 WordPress flaw is a time-of-check time-of-use, or TOCTOU, race condition. In plain terms, a security-sensitive check and the operation that follows it do not happen as one indivisible action. The gap between them can create an opportunity for an attacker.

For this vulnerability, the reported problem involves predictable, web-accessible staging paths used during full-package WordPress core upgrades. During that upgrade window, an unauthenticated attacker could execute code on the server. The NVD entry for CVE-2026-119977 provides the vulnerability record and references.

The upgrade window is an important part of the description. This is not a claim that every WordPress page request exposes the flaw, nor does detecting WordPress establish that an installation is affected.

For the affected version range, see the NVD vulnerability record linked above. Do not infer the range from the advisory’s URL, from a version seen on another site, or from a general list of WordPress vulnerabilities. Use NVD’s explicit affected-version guidance and the vendor’s remediation guidance.

Keep these questions separate:

  • Is WordPress installed? Technology detection can help answer this.
  • Is the installed core version affected? Compare the installed version with the NVD vulnerability record.
  • Was the installation compromised? That requires investigation, not just a version comparison.

Why does the CISA KEV listing matter?

CISA added this flaw to its Known Exploited Vulnerabilities catalog on 2026-11-03. A KEV listing means there is evidence of exploitation in the wild. It makes this a WordPress exploited vulnerability that warrants prompt attention, rather than only a theoretical concern.

CISA set 2026-11-06 as the action deadline for US federal agencies. That deadline is not a universal legal requirement for every WordPress owner. Both the exploitation status and the federal deadline are recorded in the CISA KEV catalog.

For a site owner, the practical response is to establish the installed version and follow the vendor’s instructions promptly. Do not wait for a public-facing scanner to report a problem before checking your installation.

A KEV listing does not mean your particular site was compromised. It also does not establish that every installation of the named product is vulnerable. Treat it as a reason to prioritize verification and remediation, not as a diagnosis of your server.

For related entries, see Sitecheckly’s list of WordPress vulnerabilities exploited in the wild. Keep the guidance for this specific CVE separate from instructions for other WordPress flaws.

How widespread is WordPress in the survey?

The October 2026 Sitecheckly survey used the Tranco top 10,000, list 7462X. The ranking covered 2026-10-02 to 2026-10-31, and home pages were fetched on 2026-11-01. Of 10,000 domains, 4,934 could be analyzed.

The remaining domains were mostly CDN, DNS and API hosts, sites asking crawlers to stay away in robots.txt, or sites blocking automated requests. The WordPress usage page provides the survey’s detection figure and sample context.

The percentage in the opening describes detected WordPress use, not the share affected by CVE-2026-119977. It does not show how many installations were vulnerable, how many underwent a relevant upgrade, or how many were compromised.

Do not use the survey’s version-exposure figures to estimate exposure to this flaw. A technology survey and an installation-specific vulnerability check answer different questions. Your next step is to check your own installed core version, not to apply the survey percentage to your site.

How can you check your WordPress version?

Start with access you control. Check the WordPress admin panel for the installed core version and record it before comparing it with the NVD vulnerability record.

If you cannot access the admin panel, inspect the page source or server response headers for version information. Treat these as possible clues, not a guaranteed inventory. An absent public version does not mean the site is safe. A public-facing lookup may identify WordPress without revealing its version.

Use this workflow:

  • Check the installation directly. Record the core version shown in the admin panel. If someone else manages updates, ask them to confirm the installed version.
  • Check the entered URL externally. The free Sitecheckly tech stack lookup can help identify publicly visible technology information. It requires no sign-up.
  • Run a separate passive check. The Sitecheckly security audit is free with no sign-up. It checks one page per run, using the URL you enter, and its security checks are passive.
  • Compare with the advisory. Use the installed core version and NVD’s affected range to decide whether the installation needs the vendor’s specified fix or mitigation.

Do not treat either lookup as proof that the whole installation is unaffected. A passive page check is not an exploitation test and cannot establish that a server was never compromised.

If the public checks do not reveal a version, keep the status as unconfirmed until you can inspect the installation or obtain confirmation from its administrator. Do not turn missing information into a clean bill of health.

How do you fix WordPress and respond to a possible compromise?

For this WordPress upgrade vulnerability, follow the vendor advisory’s fixed-release or mitigation instructions. Use the release and procedure the vendor specifies. Do not guess a fixed version or substitute an unrelated configuration change.

After applying the instructions, check the installed core version again and record what changed. If a hosting provider or developer performs the work, ask for confirmation of the resulting version and the actions taken.

If compromise is possible

Treat remediation and investigation as separate tasks. Applying a fix addresses the vulnerability; it does not, by itself, establish what happened before the fix.

Follow the vendor’s response guidance. Rotate credentials and review relevant server and application logs as part of the response. Use CISA’s forensics triage guidance as a reference when planning that review.

Use the findings to decide whether further incident-response assistance is needed. If you cannot confidently assess the evidence, involve the person or provider responsible for the server rather than relying on a passive audit result.

What to do next

  • Confirm and record your installed WordPress core version.
  • Compare it with NVD’s affected-version guidance and apply the vendor’s specified fix or mitigation.
  • If compromise is possible, complete the credential and log review, then decide whether specialist assistance is needed.

Frequently asked questions

Does a KEV listing mean my WordPress site was compromised?

No. The listing means exploitation has been observed in the wild, not that every installation was hit. Check your version and investigate signs of compromise.

Does the federal deadline apply to every WordPress site?

CISA set the stated deadline for US federal agencies. Site owners should still treat evidence of active exploitation as a reason to act promptly.

Can a passive security audit prove that my site was not compromised?

No. A passive audit checks externally observable information; it cannot replace a review of server and application logs.

Does the survey show how many sites were affected by this CVE?

No. WordPress detection alone does not establish an affected version or show whether a site was compromised.

Want to see how your own site does? Run a free audit at sitecheckly.com.

Figures in this article come from Sitecheckly's own audit data; see the methodology.