CISA Warns of Exploitation of WordPress Vulnerability CVE-2026-119977
CISA warns of active exploitation of a WordPress vulnerability, CVE-2026-119977, allowing remote code execution. WordPress has released a security update to address the issue.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
CISA warns of exploitation of a WordPress vulnerability, CVE-2026-119977.
Who is affected
WordPress versions 4.7 through 7.1.3.
Exploited
CISA has confirmed that attackers are using the flaw.
What to do
WordPress recommends blocking web access to the wp-content/upgrade directory before updating.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of a WordPress core vulnerability, identified as CVE-2026-119977. This vulnerability allows remote code execution during core updates without requiring user authentication.
The flaw affects WordPress versions from 4.7 through 7.1.3 and has been assigned a CVSS score of 8.1, indicating high severity. It was discovered by Umut Bayram, a security researcher at Picus Security.
WordPress released version 7.1.4 on October 28, 2026, to mitigate the vulnerability. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming its exploitation in the wild.
The vulnerability is described as a race condition that requires precise timing to exploit temporary update files during the update process. Wordfence reported over 240,000 requests targeting the vulnerability shortly after the security fix was issued.
WordPress recommends blocking web access to the wp-content/upgrade directory before performing updates as a precautionary measure. CISA's warning does not specify the attackers involved or the number of compromised websites.
