Attackers are exploiting a high-severity flaw in the WordPress core upgrade process, prompting the U.S. Cybersecurity and Infrastructure Security Agency to add CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on Nov. 3. CISA said the listing is based on evidence of active exploitation, but did not disclose the attackers, campaign details or indicators of compromise. [2]
The vulnerability is a time-of-check time-of-use race condition in the full-package WordPress core update process. According to the National Vulnerability Database, predictable, web-accessible staging paths can allow an unauthenticated remote attacker to execute code on a server during the upgrade window. The issue is rated high severity at 8.1 under CVSS 3.1 by Wordfence, the CVE assigning authority, with a vector indicating network reachability, no privileges or user interaction, and high impact to confidentiality, integrity and availability. NVD has not assigned its own independent score. [1]
Versions 4.7.0 through 7.1.3 are affected, spanning multiple supported and legacy WordPress branches. WordPress released version 7.1.4 on Oct. 28 as a security update and described the fix as a weakness in the upgrade process that could lead to remote code execution during the upgrade window. The project said security fixes were being backported to eligible branches through 4.7, with those updates shipping as they became ready. [1] WordPress urged administrators to update immediately. [3]
CISA’s catalog entry places the flaw under the agency’s federal vulnerability-management requirements. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV vulnerabilities on publicly exposed assets and to check whether systems were compromised before patching. CISA also encouraged organizations outside the federal government to use the catalog to prioritize risk-based remediation. [2]
Site owners should move to WordPress 7.1.4 or the applicable patched backport without waiting for a routine maintenance window, particularly when core updates are exposed to the internet. Because exploitation occurs during upgrades, administrators should also review web-server and WordPress logs around recent update activity, investigate unexpected files or processes, and rotate credentials if compromise is suspected. CISA has confirmed exploitation, but has not publicly attributed the activity to a named threat actor or published a detailed exploitation report. [2]
References
- National Vulnerability Database
- CISA Adds One Known Exploited Vulnerability to Catalog | CISA
- CVE Record: CVE-2026-119977
