The US Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress core vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, which means it has evidence the flaw is being used in real attacks. The bug, tracked as CVE-2026-119977, was fixed in WordPress 7.1.4 on October 28, 2026. If you run a WordPress site, check that it has updated.
What happened
CISA added the flaw to the KEV catalog on November 3, describing it as a time-of-check time-of-use (TOCTOU) race condition in WordPress core. The WordPress project’s 7.1.4 release post lists the fix as a weakness in the upgrade process that could allow remote code execution during the upgrade window. The release also patched several stored cross-site scripting issues, a stored denial-of-service issue in the Interactivity API and other bugs.
A report by Runtime Wire describes the problem this way: during a full-package core update, an attacker with no account can poll a predictable staging path and act in the few seconds while the official update is being unpacked. It adds that the old updater does the first extraction before the fixed code takes over, so the first update to the fixed release can still leave a site exposed.
How serious is it
Ratings differ. A Rescana analysis says WordPress rates the issue Low, while Wordfence, which published the CVE record, scores it 8.1 (High) and Patchstack rates the attack complexity as high. The attack needs several conditions at once: a full-package core update in progress, a staging folder reachable from the web with PHP able to run, a path the attacker can predict or find, and enough time before WordPress deletes the temporary files.
Rescana reports that Wordfence saw tens of thousands of requests aimed at the staging paths in the first day. Counts reported by different outlets vary, and they measure blocked attempts, not hacked sites. Rescana says no source it found reports a successful takeover, but CISA’s listing rests on evidence of active exploitation. Federal civilian agencies were told to fix it by November 6 under CISA’s Binding Operational Directive 26-04. That order does not bind private companies, but CISA urges all organisations to prioritise fixing KEV entries.
What to do
- Update. The WordPress team recommends updating immediately. Use Dashboard, then Updates, then Update Now, and confirm the version number afterwards. Sites with automatic background updates should have updated on their own, but verify rather than assume.
- Know your branch. WordPress says security fixes are being backported to all eligible older branches back to 4.7, shipping as they are ready. Rescana lists fixed releases for each branch, and says versions 4.6 and earlier get no fix and should move to a supported release.
- Restrict the upgrade folder. Rescana advises blocking web access to the wp-content/upgrade folder at the server level and making sure directory listing is off. It recommends doing this before updating, because the update itself is unpacked by the older code. If you use shared hosting, ask your host whether this is already done.
- Do not rely on a PHP-level firewall alone. Rescana notes the malicious request can bypass WordPress, and that Wordfence covers it through its Extended Protection mode, with the rule reaching free users on November 27.
- Look for signs of compromise. Check logs around core update times for requests to PHP files in the upgrade folder, and review your site for unknown administrator accounts, unexpected plugins and unfamiliar PHP files. Belgium’s CCB, per Rescana, notes that patching does not undo an earlier compromise.
What is not known
None of the sources opened for this report names a victim or a confirmed successful attack. The severity ratings are disputed, and the attack-count figures vary between outlets. Because the story was still developing at the time of writing, check the WordPress.org release post and your host’s notices for the latest guidance. For general account and device hygiene, see our guides to protecting yourself online with CISA’s core steps and scanning your PC for malware.
Sources
- CISA: Adds One Known Exploited Vulnerability to Catalog (November 3, 2026)
- WordPress.org: WordPress 7.1.4 Security Release
- Runtime Wire: CISA confirms WordPress upgrade flaw is under active exploitation
- Rescana: WordPress Core 7.1.4 upgrade staging race RCE
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
