CISA adds WordPress code execution vulnerability to KEV catalog
Original title: CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability
CVE-2026-119977 allows unauthenticated code execution during WordPress upgrades and is actively exploited.
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3 2026. The flaw lets unauthenticated attackers execute server-side code by accessing predictable staging paths during full-package upgrades. It affects WordPress branches 4.7 through 7.1.3. WordPress released 7.1.4 on October 28 to fix the issue.
- CVSS v3.1 score 8.1
- Active exploitation confirmed
- Remediation deadline November 6 for federal agencies
- Fixed in 7.1.4
- Backports available for older branches
Impact: unauthenticated server-side code execution
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 4.7 through 7.1.3 | 7.1.4 |
- 1.Upgrade to 7.1.4 or backport
- 2.Verify installed release after upgrades
- 3.Restrict public access to wp-content/upgrade directories
- CVEs
- CVE-2026-119977
- Vendors
- WordPress
- Products
- WordPress Core
- Organizations
- CISA
- Countries
- US
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.