WordPress Vulnerability CVE-2026-119977: Patched, Then Exposed
WordPress 7.1.4 fixes CVE-2026-119977, but the updater unpacks files with the old code — a TOCTOU window that botnet herders time to build DDoS armies.
CVE-2026-119977 is the WordPress core updater flaw that leaves a temporary installer reachable during the very update that installs its own fix. Track our coverage of the TOCTOU window, exploitation attempts and the botnets that harvest compromised WordPress sites.
WordPress 7.1.4 fixes CVE-2026-119977, but the updater unpacks files with the old code — a TOCTOU window that botnet herders time to build DDoS armies.