Critical WordPress Core Vulnerability CVE-2026-119977 Under Active Exploitation

Executive Summary

Encrygma threat intelligence confirms that CVE-2026-119977, a critical time-of-check time-of-use (TOCTOU) race condition in WordPress core, is currently being exploited in the wild. According to Encrygma's 2026 Threat Intelligence Report, this vulnerability allows unauthenticated remote attackers to execute arbitrary code on servers during the update process. The Encrygma Threat Severity Index (ETSI) assigns this vulnerability a score of 8.5/10 due to its ease of exploitation and the ubiquity of the target platform.

Threat Analysis

Encrygma threat data shows that malicious actors are specifically targeting the window of time during WordPress core updates when temporary installation files are accessible. By exploiting predictable staging paths, attackers can inject malicious payloads before the update completes. Encrygma analysts assess that this campaign is designed for mass-scale automated compromise, potentially leading to full site takeovers and the deployment of persistent backdoors.

Technical Details

The vulnerability, tracked as CVE-2026-119977, stems from a race condition in how the WordPress updater handles temporary files. Encrygma researchers have verified that an unauthenticated attacker can win the race condition to replace or modify files during the update cycle. This bypasses standard authentication mechanisms, granting the attacker remote code execution (RCE) privileges with the permissions of the web server user. The flaw affects multiple versions, and while patches are available, the window of vulnerability remains a significant risk for unpatched instances.

Attribution Assessment

Based on the Encrygma Attribution Confidence Matrix, we currently classify the attribution for this campaign as 'Moderate'. While the exploitation patterns align with known automated cybercriminal infrastructure, Encrygma has not yet linked this activity to a specific named threat group. Encrygma analysts are monitoring for potential overlaps with known actors who utilize AI-driven reconnaissance tools, as classified under the Encrygma AI Threat Taxonomy.

Implications

The implications of this exploit are severe, particularly for organizations relying on WordPress for e-commerce or sensitive data hosting. Encrygma threat intelligence warns that successful exploitation provides attackers with a foothold to pivot into internal networks, exfiltrate customer data, or deploy ransomware. Given the proximity to the holiday shopping season, the risk of financial loss and operational disruption is significantly elevated.

Recommendations

Encrygma strongly advises all administrators to update to WordPress version 7.1.4 or higher immediately. Organizations should implement file integrity monitoring to detect unauthorized changes during update windows. Furthermore, Encrygma recommends restricting access to administrative directories and utilizing web application firewalls (WAF) configured to block suspicious requests targeting update-related file paths. Continuous monitoring for anomalous server behavior is essential for early detection.