WordPress CVE-2026-119977: core upgrade flaw is exploited, CISA adds it to KEV

On 3 November 2026 the US agency CISA added CVE-2026-119977 in WordPress core to its catalog of exploited vulnerabilities. It hits the moment of a core upgrade and can lead to code execution on the server; the fix is in 7.1.4.

On 3 November 2026 CISA added CVE-2026-119977 in WordPress core to its Known Exploited Vulnerabilities (KEV) catalog. It is a time-of-check time-of-use race condition. Being listed in the catalog means attacks are already happening in the wild, so this is not just a theoretical risk.

According to security analyses, the attack works during a core upgrade. WordPress unpacks the new files into a folder under wp-content/upgrade whose name can be guessed. An attacker who knows that path and hits the short window during the upgrade can, as described, run their own PHP code without logging in. Sources differ on how easy that is: some describe a high attack complexity and say the folder must be reachable over the web.

The fix ships in WordPress 7.1.4, released on 28 October 2026. Reports say it also fixes other flaws, but the number differs between sources, so we do not quote it. Security firms also report first exploitation attempts within hours of disclosure. Attempt counts vary widely between reports, so treat them only as a sign that scanning is happening at scale.

The advice is consistent: update to 7.1.4 or newer and block web access to the wp-content/upgrade/ directory at the web server level. After updating, it is worth scanning the server for unknown PHP files in WordPress folders, because an update does not undo an intrusion that happened earlier.