CISA Adds WordPress Upgrade Flaw to KEV Catalog
Original title: CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code
CVE-2026-119977 allows remote code execution via race condition during WordPress upgrades.
CISA added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog on November 3, 2026. The flaw affects versions 4.7 through 7.1.3 and enables malicious code execution during the brief period when staging files remain accessible. Attackers exploit a time-of-check, time-of-use race condition in the upgrade process. WordPress released version 7.1.4 on October 28, 2026 to address the issue.
Unconfirmed: CISA confirms active exploitation but does not name specific attackers
- Affects WordPress Core 4.7 to 7.1.3
- Requires precise timing during upgrades
- CVSS score 8.1
- No user interaction needed
Impact: remote code execution on website servers
- 1.Upgrade to WordPress 7.1.4
- 2.Restrict public access to wp-content/upgrade
- 3.Review server logs for upgrade requests
- CVEs
- CVE-2026-119977
- Products
- WordPress Core
- Victims
- websites running WordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious code to run on website servers.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.