CVE-2026-119977: WordPress core staged update installer under wp-content/upgrade
HoneyLabs honeypots recorded 5 probes matching CVE-2026-119977 from 1 distinct source IP address in the last 7 days, of which 5 on interactive sensors. Severity is rated high.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2026-11-03.
One source probed for CVE-2026-119977 on the interactive sensors and sent the exploit payload.
What the sensors show
All of them arrived on one day, 2026-11-05. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i9012h2_c6771aded2ed_57a60bdf03d1.
Request paths that identify it
- /wp-content/upgrade/{{*}}/wordpress/wp-admin/setup-config.php
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 85.145.96.31 | 5 | Odido Netherlands B.V. | The Netherlands |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS50266 | Odido Netherlands B.V. | 5 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| The Netherlands | 5 |
Requests the interactive sensors answered
- GET /wp-content/upgrade/wordpress-7.1.4/wordpress/wp-admin/setup-config.php
- POST /wp-content/upgrade/wordpress-7.1.4/wordpress/wp-admin/setup-config.php
HTTP client fingerprints
- b11cuq050_00050814_6eb31df9
- b11cun030_00040014_54d07b6d
CVE report
Open a specific CVE from the CVE tracker.