WP-CLI Updates Still Require Protection Against WordPress CVE-2026-119977

Using WP-CLI does not eliminate the update-time risk associated with CVE-2026-119977. According to The Hacker News, WP-CLI uses the same updater and extracts packages into the same directory. Administrators therefore need to consider what the web server can serve while an update is running, including when installing the fix itself.

Affected versions and the fix

The vulnerability affects WordPress 4.7 through 7.1.3. Exploitation requires no account, but depends on identifying the temporary directory and reaching its installer before WordPress removes the copy. Successful exploitation can allow code execution on the server. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

WordPress released fixes in 7.1.4 and corresponding updates for older branches back to 4.7. The reported change randomizes the temporary directory name. The source states that WordPress 4.6 and earlier no longer receive security updates and have no fix.

TMGS recommendations for maintenance

TMGS recommends treating access controls and the software update as one documented change, with a named owner and evidence of completion:

• Record the current WordPress version and identify the fixed release for that branch.
• Before updating, configure the web server to block access to the upgrade directory inside wp-content.
• Verify through the web that requests to that directory return HTTP 403, and retain the result with the change record.
• Perform the update, including when using WP-CLI, then confirm the installed version and check website operation.

For externally managed websites, TMGS recommends assigning responsibility for the access check before maintenance starts: the WordPress operator and server administrator may be different people. TMGS also recommends planning migration to a supported version for systems running WordPress 4.6 or earlier.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/wp-cli-khong-bo-qua-rui-ro-cap-nhat-wordpress-i.13882967-9ea5-4aec-8692-74c38e5be600