CVE-2026-119977
Known exploited · CISA KEV
CVSS 8.1 HIGH: wordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. EPSS 0.6% (49th percentile).
CISA federal remediation date Nov 6
Vulnerabilities & Exploits
CISA confirmed on November 3, 2026, that attackers are exploiting a flaw in WordPress Core versions 4.7 through 7.1.3, and added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog.
During a full Core upgrade, temporary staging directories are reachable over the web. An unauthenticated attacker can race that brief window to get code onto the server. The opening exists only while the upgrade is underway; outside that short interval, this exploit path is unavailable.
For WordPress operators, a patched version closes future upgrade windows but does not establish whether a past one was exploited. If a site performed a full upgrade while exposed, that interval remains relevant to its compromise assessment. Federal Civilian Executive Branch agencies have until November 6, 2026, to remediate.
2 sources · 2h ago
Known exploited · CISA KEV
CVSS 8.1 HIGH: wordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. EPSS 0.6% (49th percentile).
CISA federal remediation date Nov 6
NCSC-NL Advisories
Kwetsbaarheid verholpen in WordPress Core
WordPress heeft een kwetsbaarheid verholpen in WordPress Core versies 4.7 tot en met 7.1.3.
originalThe Hacker News
CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
CISA confirms active exploitation of CVE-2026-119977, a WordPress Core flaw that allows unauthenticated code execution during upgrades.
originalPart of the PlainSec briefing for 2026-11-04
Every edition of this story: WordPress upgrade window opens a path to server code