Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CISA flags exploited WordPress core upgrade RCE CVE-2026-119977

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA listed actively exploited WordPress flaw CVE-2026-119977; patching closes it, but the upgrade itself can briefly reopen the race.

Attackers are exploiting CVE-2026-119977, an unauthenticated remote code execution bug in WordPress 4.7 through 7.1.3, via a time-of-check time-of-use race on predictable /wp-content/upgrade/ paths only during a full-package upgrade. WordPress shipped 7.1.4 and branch backports on October 28, 2026; CVSS is 8.1. Wordfence says probing started that day and later blocked more than 240,000 attempts, peaking above 74,000 on October 30. Installing the fix can still unpack files with unpatched code once. Wordfence dates the CISA KEV addition to November 2, while GBHackers says November 3; federal agencies had a November 6 remediation deadline.

Key facts
  • Affects WordPress 4.7 through 7.1.3; fixed in 7.1.4 plus branch backports.
  • Race is exploitable only during the short full-package core upgrade window.
  • Wordfence later reported over 240,000 blocked attempts since October 28.
  • Qualys cites 12,632 Wordfence blocks in 24 hours; BleepingComputer cites 13,095.
  • Qualys also reported more than 18,500 attempts in the first 21 hours.
  • Free Wordfence users receive the firewall rule on November 27, 2026.
Analyze CVE-2026-119977 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026WordPress 7.1.4 released; exploit attempts began · Wordfence
  2. Oct 30, 2026Blocked requests peaked above 74,000 · Cyber Security News
  3. Nov 2, 2026CISA added the flaw to its KEV catalog · Wordfence
  4. Nov 3, 2026GBHackers dates the CISA KEV addition · GBHackers
  5. Nov 6, 2026Federal agency remediation deadline · GBHackers
  6. Nov 27, 2026Free Wordfence firewall rule scheduled · Wordfence

What each outlet adds

beyond the shared facts
  • WordfenceNames backports 6.9.11 and 7.0.8 and a November 2 KEV date.
  • Cyber Security NewsOctober 30 peak; counts are requests, not confirmed infections.
  • The Hacker NewsInstalling the fix still unpacks files with old unpatched code.
  • GBHackersDates KEV addition November 3 and the federal deadline November 6.
  • QualysEarly attempt totals and detection QID 735969.
CVEs
CVE-2026-119977
Vendors
WordPressWordfence
Products
WordPress CoreWordfence
Victims
WordPress servers
Organizations
WordfenceCISAQualys
Countries
US

Coverage

oldest first · one row per article · UTC
  1. · 7d ago Qualys ThreatPROTECTFirst report

    CISA Adds WordPress Core Vulnerability to KEV Catalog

    CVE-2026-119977 TOCTOU race condition enables unauthenticated remote code execution during upgrades.

  2. · 7d ago GBHackers

    CISA adds WordPress code execution vulnerability to KEV catalog

    CVE-2026-119977 allows unauthenticated code execution during WordPress upgrades and is actively exploited.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-119977
Unauthenticated RCE in WordPress Core during upgrades
8.11%KEVPoC ×7
KEV