, front page
InitialReach
How we report

SecurityWordPress CoreChanged

CISA lists a flaw in WordPress's core upgrades as exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in WordPress, the free software that many websites are built and run with, to its catalog of vulnerabilities known to be exploited on 3 November, "based on evidence of active exploitation". When WordPress fixed it on 28 October, and when the flaw's public record appeared on 31 October, neither said it had been exploited.

The flaw, CVE-2026-119977, is in WordPress's own core software, versions 4.7 through 7.1.3. While a site upgrades WordPress with a full package, the files are staged at predictable paths that can be reached from the web, which can let an attacker who is not logged in run code on the server during that window, according to the flaw's record. WordPress 7.1.4 fixes it, and so, according to the flaw's record, do releases on the older branches back to 4.7, all dated 28 October.

CISA's catalog gives US federal civilian agencies a due date of 6 November and marks a check for signs of compromise as required. Under the directive the catalog points to, how fast an agency has to act on a given system depends on that system, among other things on whether it can be reached from the internet.

The WordPress upgrade flaw in CISA's catalog of exploited vulnerabilities

Before: Not listedNow: Listed on 3 November

What changed

Before CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (Internet Archive copy of 2 November), 30 October 2026Now CISA Adds One Known Exploited Vulnerability to Catalog, 3 November 2026

  1. In CISA's Known Exploited Vulnerabilities catalog

    Before

    Not listed (catalog of 30 October, 1,766 entries)

    Now

    Listed on 3 November (1,767 entries)

  2. Exploitation

    Before

    Not mentioned in WordPress's release notes of 28 October or in the CVE record published on 31 October

    Now

    CISA cites evidence of active exploitation; the EU Vulnerability Database marks it exploited since 3 November

  3. Due date in CISA's catalog for US federal civilian agencies

    Before

    None

    Now

    6 November, with a check for signs of compromise marked as required

What stayed the same

  • Affected versions: 4.7 through 7.1.3.
  • Fixed in WordPress 7.1.4 and, according to the flaw's record, in releases on each older branch back to 4.7, all dated 28 October.
  • The flaw's severity score in its record: 8.1 out of 10.

What we don't know yet

  • Who is exploiting the flaw, and how many sites have been attacked. CISA does not say what its evidence is.
  • Whether it has been used in ransomware attacks. CISA's catalog marks this as unknown.

The documents

For people in the field Identifiers, citations and the trade's shorthand, from the documents
Identifiers
CVE-2026-119977, EUVD-2026-114575. Time-of-check time-of-use race condition (CWE-367). CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, from Wordfence, which assigned the CVE. Reported to WordPress by Umut Bayram, its release notes say.
Fixed versions
Per the CVE record's affected ranges and WordPress's release list: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34 and 4.7.39, all released 28 October 2026.
Federal deadline
The catalog's due date: 6 November 2026, three days after the listing; forensic triage marked as required; known ransomware campaign use unknown. Under Binding Operational Directive 26-04, which the catalog's notes cite, each asset's remediation timeline depends on whether it is publicly exposed, its KEV status, whether exploitation can be automated and its technical impact, and changes as those facts change. CISA's coordinator assessment in the CVE record: exploitation active, not automatable, technical impact total.
Timeline
28 October, WordPress 7.1.4 and backports released and the flaw disclosed; 30 October, CVE reserved; 31 October, CVE published; 3 November, listed in CISA's catalog (version 2026.11.03) and marked exploited in the EUVD.