CISA adds WordPress flaw to KEV catalog
Original title: U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog; Wordfence recorded over 18,500 exploitation attempts in 21 hours.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity remote code execution vulnerability in WordPress to its Known Exploited Vulnerabilities catalog. The flaw affects versions 4.7 through 7.1.3 and stems from predictable staging directories used during updates. Unauthenticated attackers could exploit a race condition to execute malicious code on the server. WordPress addressed the flaw in version 7.1.4. Wordfence observed threat actors actively scanning for the vulnerability shortly after the update.
Unconfirmed: Wordfence figures document exploitation attempts, not confirmed successful compromises.
- Affected versions: 4.7 to 7.1.3
- Fixed in version: 7.1.4
- Wordfence recorded 18,500 requests in 21 hours
- CISA requires federal agencies to patch by November 6, 2026
Impact: unauthenticated remote code execution
- 1.Update WordPress to 7.1.4
- 2.Apply WordPress security patch
- CVEs
- CVE-2026-119977
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |
From the original article
1 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.