WordPress Core Flaw Exploited: CISA Adds CVE-2026-119977 to KEV

Attackers are now exploiting a WordPress core flaw, so site owners should check their version today. The bug sits in how WordPress installs full-package core updates, and it can let an unauthenticated attacker run code on a site. The US cybersecurity agency CISA added it to its Known Exploited Vulnerabilities list, with a federal patch deadline of November 6, 2026. WordPress fixed it on October 28 in version 7.1.4, with matching patches for older branches back to 4.7.

Here’s the thing: the attack window is small. The attacker has to strike while an update is running. But small windows still get hit, and the early numbers show people are trying. It lands soon after the critical PHP flaws under attack that hit many sites last month.

How the WordPress core flaw works

The weakness is a race condition. During a complete-package core update, WordPress unpacks new files into a predictable folder inside the web-served upgrade directory. An attacker who wins the race against that extraction step could reach remote code execution, and no login is needed. CISA blames predictable, web-accessible staging paths used during full upgrades. Umut Bayram found and reported the bug, and he gets the credit in both WordPress notices.

Attacks so far probe for the staged installer file setup-config.php. According to The Hacker News, Wordfence logged more than 18,500 such requests in the first 21 hours after details went public. It also blocked 12,632 attacks over a later 24-hour period. A Previdian honeypot reportedly saw three attempts on October 30.

Sources disagree on severity. The Hacker News lists the bug as CVE-2026-119977 with a CVSS score of 8.1. WordPress’s own advisory shows no CVE and labels it Low. I’d still treat it as serious, the same way we treated the GitLab bug with a public exploit, since attackers are already using it.

Which WordPress versions are affected?

Every branch from 4.7 up to 7.1 had vulnerable releases. The newest branches and their fixes look like this:

Older branches also got fixes, but WordPress says those backports are shipping as they become ready. Some may land later than 7.1.4.

What should you do now?

Update to the fixed release for your branch. WordPress hasn’t shared a workaround, so updating is the fix. Managed hosts often update sites for you, but the dashboard check takes under a minute. For the next layer of protection, our guide on stopping DDoS attacks on WordPress sites covers site hardening.

1. Open the dashboard. Go to Dashboard, then Updates, and choose Update Now. You can also download the release from WordPress.org.
2. Confirm your version. Check that the number shown matches a fixed version in the table above.
3. Don’t trust auto-updates blindly. WordPress says sites with background updates will start the update on their own. It doesn’t say if this specific fix rides along, so verify your version manually.
4. Ask your host about logs. If your site was mid-update recently, a host can review its logs. This is general advice, not from the advisory.

Update, November 5, 2026: CISA’s federal deadline is tomorrow. We’ll update this post if WordPress or CISA publishes new details.

Sources: WordPress 7.1.4 release post, The Hacker News