The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a high-severity WordPress flaw that could allow them to execute malicious code on affected servers.
The vulnerability, tracked as CVE-2026-119977, has a CVSS severity score of 8.1 and was added to CISA’s KEV catalog on Nov. 3.
The flaw affects WordPress Core versions 4.7 to 7.1.3, although vulnerable versions vary by release branch. It stems from a race condition in the platform’s software update mechanism, which can expose server-side installation files to unauthorized access.
An advisory published by WordPress security plugin developer Wordfence explained that predictable and publicly accessible staging paths created during full-package WordPress upgrades could allow unauthenticated attackers to execute code on exposed servers during the update process.
As of Nov. 4, Wordfence said its plugin blocked 12,391 attacks targeting the vulnerability over the previous 24 hours. Notably, the figures do not indicate how many attempts, if any, resulted in successful compromise.
Organizations urged to update their software
WordPress has addressed CVE-2026-119977 in version 7.1.4, which also includes fixes to other vulnerabilities. In the notes accompanying the security release, the open-source project credited researcher Umut Bayram with reporting the vulnerability and urged users to update their sites immediately.
In its advisory, Wordfence confirmed that corresponding patched releases are also available for older WordPress versions.
Now that CISA has confirmed its active exploitation, organizations operating WordPress sites should prioritize remediation, particularly if their sites offer customer-facing services or are central to their internal business operations.
CISA’s catalog entry directs federal agencies to apply mitigations in line with vendor instructions and to meet its forensic triage requirements under Binding Operational Directive 26-04, so patching alone may not be enough.
CISA has set Nov. 6 as the remediation deadline for federal civilian agencies, underscoring the urgency of addressing the flaw.
