CISA Adds WordPress Core Vulnerability to KEV Catalog
Original title: CISA Warns of WordPress Vulnerability Exploited in the Wild (CVE-2026-119977)
CVE-2026-119977 TOCTOU race condition enables unauthenticated remote code execution during upgrades.
CISA added a WordPress core flaw to its Known Exploited Vulnerabilities catalog. The vulnerability arises from predictable staging paths in full-package upgrades allowing unauthenticated remote code execution. More than 18,500 exploitation attempts were observed in the first 21 hours after disclosure.
- Flaw present in versions 4.7.0 to 7.1.3.
- Wordfence blocked 12,632 attempts in 24 hours.
- Exploitation possible only during short upgrade window.
- Mitigation versions listed up to 7.1.4.
- Qualys QID 735969 detects vulnerable assets.
Impact: unauthenticated remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 4.7.0 – 7.1.3 | 4.7.39, 4.8.34, ..., 7.1.4 |
- 1.Update to patched versions
- 2.Apply WordPress Security Advisory mitigation
- CVEs
- CVE-2026-119977
- Vendors
- WordPress
- Products
- WordPress Core
- Victims
- WordPress servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |
From the original article
1 min read at threatprotect.qualys.comThe U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress core vulnerability to the Known Exploited Vulnerabilities catalog.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.