WordPress administrators should prioritize a core security update after CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. The flaw can allow an unauthenticated attacker to execute code on a server during a WordPress upgrade window. For site owners, the practical message is to update promptly, protect the maintenance process, and check for signs of earlier compromise.
The Hacker News flagged the development in its November 4 report. Its full article was inaccessible during preparation of this advisory, so the details below are grounded in its RSS summary, CISA’s catalog entry, and the official WordPress security release announcement.
What CISA confirmed
CISA added the vulnerability on November 3, 2026, citing a time-of-check time-of-use, or TOCTOU, race condition in WordPress Core. Its description identifies predictable, web-accessible staging paths used during full-package core upgrades as the underlying exposure.
In practical terms, a race condition creates a gap between a security-relevant check and a later operation. Here, CISA says an attacker does not need to authenticate to exploit the upgrade window and execute server-side code. This is an upgrade-process issue, not a vulnerability in an optional third-party plugin.
The catalog listing establishes that exploitation has occurred in the wild. It does not establish that every vulnerable WordPress installation has been compromised. CISA lists ransomware campaign use as “Unknown,” which should not be interpreted as evidence that ransomware involvement is impossible.
Which update addresses the problem?
The official WordPress 7.1.4 announcement, published October 28, explicitly includes a fix for an upgrade-process weakness that can lead to remote code execution during the upgrade window. WordPress recommends updating sites immediately.
For installations on the 7.1 release line, deploy 7.1.4 or a later appropriate stable security release. Administrators maintaining older branches should verify the exact patched release available for their branch rather than assuming the newest backport is already installed. The announcement says backports extend through the 4.7 branch but were still being shipped as they became ready. It also cautions that only the most recent WordPress version is actively supported.
Do not assume automatic updates have completed successfully. Confirm the installed version on each production site, including secondary sites and installations managed by a hosting provider.
A practical response checklist
- Inventory exposed installations. Identify internet-facing WordPress sites, their core versions, and who controls their update process. Include forgotten staging environments that remain publicly reachable.
- Prepare a recoverable backup. Preserve the database and site files, and confirm that restoration is possible. A backup is a recovery precaution, not a mitigation for this vulnerability.
- Coordinate the upgrade with your host. Because the vulnerable operation is the upgrade itself, ask about vendor-supported protections during maintenance. Where operationally feasible, restrict external access at the hosting or reverse-proxy layer during the change. Do not assume a cosmetic maintenance page prevents access to staging files.
- Apply the security release promptly. Follow official WordPress and hosting-provider instructions. Avoid delaying the fix while waiting for a routine feature-upgrade cycle.
- Verify the outcome. Check the installed version, update completion, public pages, administrative access, and critical functions such as checkout or forms.
These are defensive operational recommendations, not a claim that a particular access-control rule is an officially validated workaround.
Patching does not remove an existing compromise
Review web-server and hosting logs around recent core upgrades, and investigate unexpected executable files, unfamiliar administrator accounts, and unexplained changes to site behavior. These are general investigation leads, not confirmed indicators specific to this campaign. Preserve relevant logs before routine retention or cleanup removes them.
If compromise is suspected, involve the hosting provider or an incident-response specialist. Installing a patched release closes the addressed weakness but does not by itself remove malicious files, revoke stolen credentials, or establish that the site is trustworthy.
CISA’s catalog gives this entry a November 6 remediation due date and flags forensic triage. Organizations subject to the referenced federal requirements should consult the applicable guidance directly; that deadline is not a universal legal obligation for every private website owner. Active exploitation nevertheless makes this an urgent operational priority.
Sources
- CISA Known Exploited Vulnerabilities catalog data - Official WordPress 7.1.4 security release announcement - The Hacker News source