Vulnerabilities · 2h ago

WordPress upgrade window opens a path to server code

CISA confirmed on November 3, 2026, that attackers are exploiting a flaw in WordPress Core versions 4.7 through 7.1.3, and added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog.

During a full Core upgrade, temporary staging directories are reachable over the web. An unauthenticated attacker can race that brief window to get code onto the server. The opening exists only while the upgrade is underway; outside that short interval, this exploit path is unavailable.

For WordPress operators, a patched version closes future upgrade windows but does not establish whether a past one was exploited. If a site performed a full upgrade while exposed, that interval remains relevant to its compromise assessment. Federal Civilian Executive Branch agencies have until November 6, 2026, to remediate.

CVE-2026-119977

NVD KEV

Known exploited · CISA KEV

CVSS 8.1 HIGH: wordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. EPSS 0.6% (49th percentile).

CISA federal remediation date Nov 6

Timeline

Nov 6 CISA federal deadline for CVE-2026-119977
Nov 4 Reported by NCSC-NL Advisories
Nov 3 CVE-2026-119977 added to CISA KEV

Sources

2 sources covering this story

NCSC-NL Advisories Nov 4
Kwetsbaarheid verholpen in WordPress Core
WordPress heeft een kwetsbaarheid verholpen in WordPress Core versies 4.7 tot en met 7.1.3.
The Hacker News Nov 4
CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
CISA confirms active exploitation of CVE-2026-119977, a WordPress Core flaw that allows unauthenticated code execution during upgrades.

Entities

CVE-2026-119977

Part of the PlainSec briefing for 2026-11-04

Editions

Briefing for 2026-11-04

Vulnerabilities · 2h agoWordPress upgrade window opens a path to server codeCISA confirmed on November 3, 2026, that attackers are exploiting a flaw in WordPress Core versions 4.7 through 7.1.3, and added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog.During a full Core upgrade, temporary staging directories are reachable over the web. An unauthenticated attacker can race that brief window to get code onto the server. The opening exists only while the upgrade is underway; outside that short interval, this exploit path is unavailable.For WordPress operators, a patched version closes future upgrade windows but does not establish whether a past one was exploited. If a site performed a full upgrade while exposed, that interval remains relevant to its compromise assessment. Federal Civilian Executive Branch agencies have until November 6, 2026, to remediate.