[Urgent] WordPress Core CVE-2026-119977: Added to CISA KEV on Nov 3 — Targets the Core Update Itself; Update to 7.1.4 / 7.0.8 / 6.9.11 or Your Branch's Fixed Release (CVSS v3.1 8.1)

CVE-2026-119977, a flaw in WordPress Core, was added on November 3, 2026 to the KEV (Known Exploited Vulnerabilities) catalog of CISA, the US cybersecurity agency. KEV lists vulnerabilities that have actually been exploited. An unauthenticated attacker may be able to run code on the server while a WordPress core update is in progress. The fixes shipped on October 28, 2026 in 7.1.4 (7.1 branch), 7.0.8 (7.0 branch), 6.9.11 (6.9 branch), 6.8.12 (6.8 branch) and the other branch releases. Check the version your site runs in the admin screen and update to the fixed release.

Sites with automatic updates enabled may already be updated. WordPress.org says the update begins automatically on sites that support automatic background updates. If you turned automatic updates off, if an update failed, or if a hosting company or web agency manages updates for you, check the version yourself. If you do not run WordPress, this does not affect you.

Where the score comes from: 8.1 (CVSS v3.1: network vector, high attack complexity, no privileges required, high impact on confidentiality, integrity and availability) is the rating NVD shows from the party that assigned the CVE (Wordfence). As of November 3, NVD lists the record as "Undergoing Analysis" and has no NIST score yet. The number may change once NIST scores it.

What is happening (within what has been published)

• ▸CVE-2026-119977: according to the NVD record, the staging locations used during full-package core upgrades are predictable and reachable from the web, so an unauthenticated attacker can execute code on the server during the upgrade window. The CVE record was published on October 31
• ▸The official description: the WordPress.org 7.1.4 announcement lists "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window." HelpHub, the official version documentation, calls it "a race condition during core updates that could lead to remote code execution." NVD and CISA tie this flaw to the WordPress.org 7.1.4 announcement
• ▸Exploitation: CISA adding it to KEV (November 3) means exploitation has been observed. The KEV entry is marked for forensic triage, meaning a check for signs of compromise comes first. We found no detail on the scale or method of attacks in the sources we could read
• ▸Other issues fixed in the same 7.1.4: several other problems, including stored cross-site scripting (XSS), were fixed together. This article covers only CVE-2026-119977, the one in KEV

Affected versions and the release to move to

• ▸Affected: 4.7 through 7.1.3 (NVD CVE record). In other words, anything before the fixed release of its branch: before 7.1.4 on the 7.1 branch, before 7.0.8 on the 7.0 branch, and so on
• ▸Fixed release per branch (all published October 28; checked on WordPress.org HelpHub): 7.1.4 for 7.1, 7.0.8 for 7.0, 6.9.11 for 6.9, 6.8.12 for 6.8, 6.7.11 for 6.7, 6.6.11 for 6.6, 6.5.14 for 6.5 and 6.4.14 for 6.4. Branches 6.3 and earlier also got releases the same day (6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34, 4.7.39). The HelpHub page of each release lists a race condition during core updates that could lead to remote code execution
• ▸Move to the latest, 7.1.4, if you can: WordPress.org states that only the most recent version of WordPress is actively supported. If you are on an older branch, consider moving to 7.1.4

What to do today

• ✓★In the admin screen, open "Dashboard" → "Updates" and check your WordPress version. If it is older than the fixed release above, you are affected
• ✓★Update to the fixed release. Use "Updates" in the admin screen, or download from https://wordpress.org/download/releases/ (per WordPress.org). Take a backup of the site and database first
• ✓Confirm that any automatic update actually completed. Automatic updates can fail. Check that the version is the fixed one
• ✓If you ran a core update before moving to the fixed release, check for signs of compromise to be safe. Look for administrator accounts you do not recognize, files in the WordPress folders you do not recognize, and changes to how the site displays. This is general inspection, not a procedure published by the vendor
• ✓If someone else manages the site, ask your hosting company or web agency whether it has been updated to the fixed release

If you cannot update right away

The sources we could read (the WordPress.org announcement and HelpHub, NVD and the CISA KEV entry) mention no workaround for this vulnerability. We do not list unofficial stopgaps as steps, because we cannot vouch for them. If the update is delayed, for example while you check plugin compatibility, make the update your top priority and set the date first. Until then, do these two things.

• ▸Put internet-facing sites first. The KEV addition is the reason for the order
• ▸Inspect for compromise after updating. The record says the flaw targets the update itself. Updating to the fixed release does not undo an intrusion that happened around the time of an earlier update

What we could not confirm

• ▸Wordfence's technical write-up. The Wordfence page NVD references would not load when we checked (it needs a browser mechanism). We cannot show the details of the mechanism or indicators of compromise
• ▸A NIST score. NVD was still analyzing the record on November 3. The 8.1 is the rating of the party that assigned the CVE
• ▸The scale of attacks and the attacker. The sources we could read gave no numbers or attacker information
• ▸Damage in Japan. This article cannot show it

Three lines to share

• ▸CVE-2026-119977 in WordPress Core was added to CISA's "known exploited" catalog (KEV) on November 3. An unauthenticated attacker may run code on the server while a core update is in progress
• ▸★Check your version under "Updates" in the admin screen and move to the fixed release for your branch: 7.1.4 (7.1), 7.0.8, 6.9.11, 6.8.12 and so on. Confirm that any automatic update finished
• ▸Inspect for intrusion too. The sources we could read mention no workaround. Ask your hosting company or web agency whether the site has the fixed release

Pages this is based on