CISA has added a WordPress core upgrade flaw, now tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities (KEV) catalog, according to several outlets reporting on the listing. The bug can let an unauthenticated attacker run code on a site during a core update, and the KEV entry signals real-world exploitation. WordPress 7.1.4 already fixes it.
This is a follow-up to our October 31 report on the 7.1.4 release. What is new is the CVE identifier and the KEV listing.
What happened
WordPress.org shipped 7.1.4 on October 28 as a security release. Its announcement describes a weakness in the upgrade process that can lead to remote code execution during the upgrade window, reported by Umut Bayram. The post did not name a CVE.
Coverage published November 4 and 5 by The Hacker News and PBX Science says the flaw is CVE-2026-119977, a time-of-check to time-of-use race condition scored CVSS 8.1. Both place the KEV addition on November 3. PBX Science and The Hacker News give a federal remediation deadline of November 6 for civilian agencies.
The risk exists only while a full-package core update is unpacking. During that short window, predictable, web-accessible staging paths can expose the installer, and an attacker who wins the race may reach it. PBX Science says routine plugin and theme updates are not affected. The Hacker News reports Wordfence recorded more than 18,500 requests aimed at staged setup-config.php paths in the first 21 hours after disclosure, and Previdian saw three attempts against a honeypot on October 30. Those are vendor telemetry figures, not confirmed compromises.
Who is affected
Any WordPress site that performs full core updates on an unpatched version is potentially exposed. The Hacker News linked a Wordfence record whose address suggests versions 4.7 through 7.1.3, but the article text does not state a range, so we treat that as unconfirmed. WordPress.org says fixes are being backported to all branches that receive security fixes, currently back to 4.7, and that those releases will ship as ready. PBX Science lists specific backport versions, which we have not independently confirmed.
What to do
- Update to WordPress 7.1.4, or to the patched release for your branch once it is available. Sites with automatic background updates should begin updating on their own, per WordPress.org.
- Until you are patched, PBX Science suggests blocking web access to wp-content/upgrade/. Test this first, because it may interfere with updates.
- After updating, review server logs for requests to PHP files under wp-content/upgrade, and check for administrator accounts, plugins or files you do not recognize. This follows Wordfence guidance as relayed by The Hacker News.
- Our analysis: schedule core updates for low-traffic periods and confirm afterward that the upgrade directory has been cleaned up.
What we still do not know
We could not open CISA’s own alert or catalog entry, so the listing date and deadline rest on secondary reporting. No source we reviewed says how many sites, if any, have been compromised. Patchstack, quoted by Remio, calls the attack window extremely short and practical exploitation difficult. The exact affected range and the status of older-branch patches also remain unclear.
Sources: WordPress.org, WordPress 7.1.4 (October 28, 2026); The Hacker News, CISA Confirms Hackers Exploiting WordPress Core Flaw (November 4, 2026); PBX Science (November 4, 2026); Remio (November 5, 2026).
Leave a Reply