WordPress Core Vulnerability Now Under Active Attack
A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.
Key Takeaways:
- – CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- – The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- – Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- – Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when
The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.
The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.
How the flaw works
During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.
The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.
Why the ratings disagree
Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress’ own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.
Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA’s KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.
Who is exposed
Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.
The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.
What to do in the next 24 hours
Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.
Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.
Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.
What happens next
Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.
The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.
For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.
Frequently Asked Questions
What is CVE-2026-119977?
It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.
Which WordPress versions are affected?
Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.
Does updating to 7.1.4 fully protect my site?
Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.
Bottom line
The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA’s November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.
Sources:
- https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog
- https://wordpress.org/news/2026/10/wordpress-7-1-4/
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4w3m-c66w-69mg
- https://patchstack.com/articles/wordpress-7-1-4-security-release/
