CISA Adds WordPress Core Flaw to Actively Exploited Vulnerabilities
CISA lists CVE-2026-119977 in WordPress Core as an actively exploited vulnerability. The fix is included in WordPress 7.1.4, with fixes for older supported branches also being prepared.
On November 3, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added WordPress CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. The addition means the agency has recorded exploitation of the vulnerability in practice. The issue affects the WordPress content management system core, specifically its update process.
WordPress released security version 7.1.4 on October 28, 2026, and recommended that users update immediately. The Canadian Centre for Cyber Security also states that WordPress Core installations before version 7.1.4 are affected.
WordPress CVE-2026-119977 Can Be Exploited During an Update
According to CISA and WordPress descriptions, the flaw could lead to remote code execution during the core update window. Based on the available description, an attacker could execute code on the server without logging in, but only while a complete WordPress Core update is in progress.
This is not a vulnerability in a standalone plugin or theme, but a problem directly in WordPress core. The risk is particularly high for unupdated installations that perform a complete core update.
The Fix Is in Version 7.1.4; Older Branches Are Awaiting Backports
WordPress version 7.1.4 includes a fix for this weakness. When it released the version, WordPress stated that it was also preparing backported fixes for supported branches down to version 4.7. However, the verified notice did not list all already released fixed versions for older branches; when 7.1.4 was released, these backports were still in progress.
Website operators should check their WordPress version and move to 7.1.4 or the relevant fixed version of an older supported branch when available. It is also important to monitor WordPress announcements when planning core updates.
The Scope of Exploitation Is Not Yet Public
For WordPress CVE-2026-119977, CISA confirms active exploitation, but publicly available information does not identify specific campaigns, attackers, or compromised websites. There are also no documented details about the practical reliability of exploitation or the scope of any compromises.
Further information may appear along with exact numbers for fixed versions in older branches, technical details from WordPress, CISA, or security researchers, and possible indicators of compromise.
Sources
- CISA Known Exploited Vulnerabilities Catalog – CISA lists CVE-2026-119977 as a known actively exploited vulnerability and describes the risk of unauthenticated code execution during an update.
- WordPress 7.1.4 – WordPress confirms a fix for a flaw in the update process that could lead to remote code execution during the update window and recommends an immediate update.
- Canadian Centre for Cyber Security: WordPress security advisory AV26-1117 – Independently confirms that CISA added CVE-2026-119977 to KEV on November 3, 2026, and identifies WordPress Core before version 7.1.4 as affected.
Verified and updated: 11/04/2026 06:20
