Picus Security Blog

picus-security-blog · B · candidate

https://www.picussecurity.com/resource/blog

researchvulnslang: enfetch failures: 0quiet periods: 0last fetch: 2026-11-07

2026-11-07 run 2026-11-07T0256Z-intel: added as candidate. Its researcher found the WordPress core upgrade-window race (CVE-2026-119977) and the post of 2026-11-05 is the discoverer's own account of the update that installs the fix still being exposed; read cleanly with `extract`.

Cited in 1 entry

Citation cadence

Citation days per ISO week (1 weeks of coverage span, total 1).

WordPress core 4.7 to 7.1.3: an unauthenticated race in the core update process can lead to remote code execution, fixed in 7.1.4 and backported to every supported branch, listed by CISA as exploited; Wordfence assigned CVE-2026-1199772026-10-30