# The upgrade window was the door

2026-11-03

CISA added WordPress Core CVE-2026-119977 to KEV. A TOCTOU race in full-package upgrades: predictable, web-reachable staging paths. Unauthenticated code execution during the window. Patched in 7.1.4 on 28 October. Federal due date Friday. Wordfence said it blocked 13,095 hits in a day.

Canonical: https://www.fabiocti.com/notes/the-upgrade-window-was-the-door/
Author: Fabio Correia

The patch window is the attack window.

CISA today put WordPress Core CVE-2026-119977 on the exploited list. Time-of-check time-of-use in the full-package upgrade. Staging paths that are predictable and reachable from the web. While the core is replacing itself, someone with no login can put code on the server. WordPress shipped 7.1.4 on 28 October and called it a security release down the 4.7 line. Federal boxes have until Friday. The directive also wants a look at whether the window was used, not only that 7.1.4 is on.

Wordfence’s weekend update: 13,095 blocked hits on this bug in 24 hours. That is their sensor, not a victim count. It is enough to explain why CISA did not wait.

This is not a plugin. It is the upgrade the site runs on itself. A still-green dashboard is evidence about today’s version string. It is not a finding that nobody raced the copy.

## What Friday will be asked to cover

It will be briefed as every WordPress on earth already owned. It is a race during an upgrade, on boxes that have not taken 7.1.4, with a look-back attached. It will be briefed as a Japanese member file. It is not. Do not add it to Arara’s 77 million.

If you run WordPress, including a campaign site a vendor still “maintains,” the version and the look-back are the incident. A mail that already knows the CVE and offers to “finish the upgrade” is not WordPress.

The upgrade window was the door. The due date is Friday.