CISA adds actively exploited WordPress Core flaw to KEV

On November 3, the U.S. Cybersecurity and Infrastructure Security Agency placed CVE-2026-119977 on its Known Exploited Vulnerabilities list, confirming evidence of active exploitation. WordPress released version 7.1.4 on October 28 with a patch, and the WordPress security team described the issue as "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window".

The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition during complete core updates. During full-package core upgrades, WordPress uses predictable, web-accessible staging paths under wp-content/upgrade, and an attacker who reaches the staged installer before cleanup can connect the temporary installation to a database they control. The flaw impacts WordPress Core versions 4.7 through 7.1.3, with a CVSS score of 8.1. No account or user interaction is required, but exploitation relies on careful timing while WordPress performs a complete core upgrade. According to BleepingComputer, the flaw permits unauthenticated remote attackers to execute code on the server, but the attack is highly complex. Picus Security researcher Umut Bayram reported the vulnerability.

Under Binding Operational Directive 26-04, CISA told federal executive branch agencies to secure affected systems by November 6 and asked every network defender, from the public and private sectors, to patch quickly. The agency warned, "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise". The agency has not identified the attackers or said how many websites were compromised. Wordfence said it blocked 13,095 attacks targeting the vulnerability in a 24-hour period. Meteora Web cited The Hacker News as reporting more than 18,500 attempts to reach setup-config.php within the first 21 hours, alongside 12,632 blocked attacks in a separate 24-hour period. Previdian said its honeypot received three exploitation attempts on October 30.

WordPress 7.1.4 also fixes stored XSS flaws in the Categories, Playlist, and Image blocks, as well as issues in the Interactivity API and Customizer. Backports for eligible older branches down to version 4.7 are still being prepared and will be released when ready. WordPress 7.2 is expected on December 8, according to Meteora Web.

In July, WordPress fixed a critical chain known as wp2shell; public exploit code appeared the day after the patches shipped. BleepingComputer said a Chinese-speaking attacker abused that chain in September to exfiltrate data from over 18,500 records held in backend databases at small businesses and government bodies.

Update to 7.1.4 right away, then confirm the security release completed installation from the Dashboard. While a site remains unpatched, blocking public web access to the upgrade directory can limit exposure. Review server logs for odd requests to PHP files inside wp-content/upgrade, and look into any new administrator accounts, plugins, or file modifications. Teams that handle many client sites should not overlook older, forgotten installations. A web application firewall adds another layer of defense, but it does not replace the WordPress Core update.