CISA ADDS ACTIVELY EXPLOITED WORDPRESS CORE VULNERABILITY TO KEV CATALOG

THREAT SUMMARY

Category: Known Exploited Vulnerability / WordPress Security / Remote Code Execution / Web Application Security
Affected Product(s): WordPress Core
CVE: CVE-2026-119977
Primary Risks: Remote code execution during a vulnerable WordPress Core upgrade process, unauthorized execution of code, and potential compromise of affected WordPress installations
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Vulnerable WordPress Core releases across version branches 4.7 through 7.1.3, subject to branch-specific security fixes
Attack Vector: Network-based exploitation of a Time-of-Check Time-of-Use race condition during the WordPress upgrade process
CVSS: 8.1 — High (CVSS v3.1, Wordfence assessment)
CWE: CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition
CISA Action: CVE-2026-119977 added to the Known Exploited Vulnerabilities Catalog on November 3, 2026
Required Response: Update affected WordPress installations to version 7.1.4 or an appropriate patched branch release. Federal Civilian Executive Branch agencies must comply with applicable BOD 26-04 requirements, including the November 6, 2026, KEV remediation deadline for covered assets.

---

The Cybersecurity and Infrastructure Security Agency added CVE-2026-119977, a WordPress Core Time-of-Check Time-of-Use race condition vulnerability, to its Known Exploited Vulnerabilities Catalog on November 3, 2026, following evidence of active exploitation.

The vulnerability affects the WordPress Core upgrade process and can create an opportunity for remote code execution during a vulnerable upgrade window. WordPress addressed the weakness in its October 28 security release, version 7.1.4, and announced that corresponding fixes were being prepared for eligible older branches. CISA’s KEV designation establishes that exploitation has occurred in real-world activity rather than remaining confined to theoretical research.

WordPress supports websites across publishing, commerce, government, education, and other sectors. The combination of confirmed exploitation, potentially serious consequences, and the platform’s extensive deployment makes prompt identification and remediation of affected installations an operational priority.

---

Vulnerability Details

CVE-2026-119977 — WordPress Core Time-of-Check Time-of-Use Race Condition Vulnerability

CVE-2026-119977 is a Time-of-Check Time-of-Use (TOCTOU) race condition affecting the WordPress Core upgrade process. The vulnerability is classified under CWE-367 and has received a CVSS v3.1 severity score of 8.1, rated High, from Wordfence.

A TOCTOU vulnerability occurs when a system checks the state of a resource and performs an operation based on that check after a delay. If an attacker can modify the relevant resource between those operations, the system may act on information that is no longer valid. In this case, the weakness affects the handling of files during WordPress upgrades, creating an opportunity for unauthorized code execution during the vulnerable upgrade window.

WordPress confirmed the underlying security weakness in its October 28, 2026, announcement for version 7.1.4. The project identified the possibility of remote code execution during the upgrade process and included a security fix addressing the issue. The vulnerability was reported by security researcher Umut Bayram.

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities Catalog on November 3 after establishing evidence of active exploitation. This designation confirms that the vulnerability has been exploited in real-world activity, although CISA’s public alert does not identify the responsible threat actors, disclose individual victims, or provide a complete account of observed intrusions.

The exploit window is particularly important because exposure is associated with the upgrade process rather than routine content publication or ordinary website browsing. Administrators should address vulnerable installations through verified security releases and investigate suspicious activity when available evidence indicates that exploitation may have occurred.

---

Affected Products and Environments

CVE-2026-119977 affects WordPress Core and is not a vulnerability in an individual third-party plugin or theme. Vulnerable releases span multiple WordPress version branches, including older installations that continue to operate on production websites, development servers, staging environments, and externally managed hosting infrastructure.

WordPress 7.1.3 and earlier releases in the 7.1 branch are affected, with version 7.1.4 providing the current-branch security correction. WordPress also announced security backports for eligible older branches, with releases scheduled to become available as the work was completed. Organizations should verify the correct patched release for each installed branch rather than assuming one version number applies universally.

WordPress published version 7.1.4 on October 28, 2026, and urged administrators to update immediately. The project confirmed that the relevant security changes were being backported to eligible older branches extending through WordPress 4.7. It also emphasized that only the most recent WordPress release receives active support.

Organizations managing multiple WordPress installations should identify the exact Core version deployed on each system, confirm whether the appropriate security correction is installed, and prioritize remediation of publicly exposed environments. Production websites, staging servers, development instances, abandoned projects, and externally hosted installations should all be included in the inventory.

Systems handling sensitive information, supporting authenticated services, or connecting to business-critical infrastructure warrant particular attention because a successful compromise could affect more than the public website.

---

Operational Impact

The confirmed exploitation of CVE-2026-119977 raises the operational priority of affected WordPress installations beyond routine vulnerability maintenance. The weakness can allow unauthorized code execution during the vulnerable Core upgrade process, creating opportunities for attackers to compromise systems that administrators are attempting to maintain or secure.

The consequences of successful remote code execution may include unauthorized changes to application files, malicious server-side activity, persistence mechanisms, credential exposure, or access to other resources available to the compromised process. The actual scope depends on the permissions, configuration, and security boundaries of the affected environment.

Publicly accessible WordPress deployments warrant particular attention because attackers can identify exposed systems and attempt exploitation during vulnerable maintenance operations. Organizations operating multiple sites should also account for development and staging infrastructure, where security controls and monitoring may differ from production environments.

CISA has confirmed exploitation of the vulnerability but has not publicly established that every potentially affected installation has been compromised. Organizations should therefore evaluate their own exposure, remediation status, and available evidence of unauthorized activity rather than assume either safety or compromise based solely on the KEV listing.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog is designed to identify vulnerabilities for which exploitation has moved beyond theoretical risk.

Potential KEV additions must meet defined requirements that include:

• An assigned CVE identifier
• Evidence that exploitation is occurring
• Clear mitigation or remediation guidance

The November 3 addition confirms that CVE-2026-119977 satisfies CISA’s requirements for inclusion.

For defenders, this means the vulnerability should receive greater priority than vulnerabilities for which exploitation has not been observed. Organizations should account for real-world attacker activity when determining remediation order rather than relying solely on routine patch schedules or vulnerability backlogs.

KEV status also changes the question security teams need to ask. The issue is no longer limited to whether a WordPress installation is vulnerable. Organizations must also determine whether an exposed installation may have been targeted or compromised before remediation.

---

Federal Response

Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk establishes risk-based vulnerability-management requirements for Federal Civilian Executive Branch agencies. The directive prioritizes remediation of high-risk vulnerabilities, particularly those listed in CISA’s Known Exploited Vulnerabilities Catalog that affect publicly exposed assets and can provide an attacker with total control following successful exploitation.

CISA added CVE-2026-119977 to the KEV Catalog on November 3, 2026, with a catalog remediation date of November 6, 2026. Federal agencies must determine which affected assets fall within the directive’s requirements and implement the applicable remediation actions by the established deadline.

BOD 26-04 also establishes requirements for evaluating whether systems were compromised before security updates were applied. These assessments are particularly important when a vulnerability is known to have been exploited and the affected system was accessible during a relevant exposure period.

The directive applies specifically to Federal Civilian Executive Branch agencies. Organizations outside the federal government are not automatically subject to its mandatory requirements, but CISA encourages them to prioritize KEV vulnerabilities through risk-based vulnerability management.

For WordPress administrators, the federal response reinforces the need to identify vulnerable installations, deploy verified security corrections, and determine whether suspicious activity occurred before remediation was completed.

---

Defensive Guidance

Organizations responsible for WordPress environments should begin with asset identification and confirmation of exposure rather than assuming that every installation is already accounted for.

• Identify all WordPress Core installations under organizational control, including production, development, staging, and externally hosted environments.
• Verify installed WordPress versions against CVE-2026-119977’s affected version ranges.
• Update affected current-branch installations to WordPress 7.1.4 and older installations to their corresponding patched branch releases.
• Confirm that WordPress Core updates have completed successfully and that the appropriate security corrections are installed.
• Prioritize publicly exposed systems and installations supporting critical organizational functions.
• Review web-server and application logs for suspicious activity associated with the WordPress upgrade process.
• Examine WordPress Core files and relevant filesystem locations for unauthorized modifications.
• Review administrative accounts, plugins, themes, scheduled tasks, and configuration files for suspicious changes.
• Preserve relevant security logs and forensic evidence when compromise is suspected.
• Investigate unusual PHP execution, unexpected server-side files, and unauthorized changes occurring during or around upgrade activity.
• Assess connected infrastructure and privileged credentials if evidence indicates successful compromise.
• Maintain verified backups and tested recovery procedures.
• Continue monitoring CISA, the WordPress Security Team, and authoritative vulnerability records for updated technical guidance.

Organizations should also confirm that security responsibilities for externally hosted or third-party-managed WordPress installations are clearly assigned. Outsourcing hosting does not eliminate the need to know whether vulnerable WordPress systems exist within an organization’s digital footprint.

---

Compromise Assessment

Remediation addresses the vulnerability going forward, but it does not establish that exploitation did not occur before the security update or mitigation was applied.

Because CISA has confirmed active exploitation, organizations with potentially affected WordPress systems should consider whether a compromise assessment is warranted based on exposure and system importance.

Defenders should review available evidence for:

• Unexpected administrator or privileged accounts
• Unauthorized changes to existing user accounts
• Suspicious authentication activity
• Unexpected modifications to WordPress Core files
• Unrecognized plugins or themes
• Changes to configuration files
• Unexpected scheduled tasks or persistence mechanisms
• Suspicious PHP files or other unfamiliar server-side content
• Unexplained outbound connections
• Changes to website content that were not authorized
• Unusual activity within web-server, application, authentication, and security logs

Security teams should avoid treating the absence of obvious website defacement as evidence that no compromise occurred. An attacker seeking persistence, credential access, data theft, or continued system access may have no reason to visibly alter the public website.

If suspicious activity is identified, organizations should preserve forensic evidence, isolate affected systems when necessary, review credentials associated with the installation, assess connected infrastructure, and determine whether unauthorized access extended beyond the WordPress environment.

---

30-Day Outlook

The inclusion of CVE-2026-119977 in the KEV Catalog is likely to increase defensive attention around WordPress Core deployments during the coming weeks as organizations identify affected systems and apply remediation.

Confirmed exploitation can also increase attacker interest because the KEV designation publicly establishes that the vulnerability has demonstrated real-world utility.

Organizations with large web environments face an additional challenge: identifying WordPress installations that may not appear in current inventories. Legacy sites, abandoned projects, staging servers, development deployments, and externally managed websites can remain exposed even when primary production systems have been updated.

During the next 30 days, defenders should focus on completing inventory, confirming remediation, examining vulnerable systems that were publicly accessible before remediation, and monitoring authoritative guidance for additional technical details.

The strongest response is not limited to patch deployment. Organizations need to know which systems were vulnerable, how long they were exposed, and whether available evidence indicates that exploitation occurred during that period.

---

TRJ Verdict

CISA’s November 3 addition of CVE-2026-119977 to its Known Exploited Vulnerabilities Catalog confirms that a serious WordPress Core security weakness has moved beyond theoretical risk. The vulnerability affects the platform’s upgrade process and creates an opportunity for remote code execution during a vulnerable maintenance window.

WordPress addressed the weakness in its October 28, 2026, security release, version 7.1.4, and announced corresponding security backports for eligible older branches. With active exploitation confirmed and a CVSS v3.1 score of 8.1 assigned by Wordfence, organizations have sufficient technical information to identify affected installations and prioritize remediation.

The vulnerability also illustrates an important security concern: software maintenance operations are themselves potential attack surfaces. An organization cannot assume that initiating an update automatically protects a system when the update mechanism contains an exploitable weakness.

For administrators responsible for public-facing WordPress infrastructure, the appropriate response is to verify installed versions, apply the correct security releases, preserve relevant security telemetry, and assess whether exploitation occurred before remediation.

The priority is not simply to complete an update. It is to establish that the vulnerable upgrade process has been secured and determine whether attackers exploited the weakness while it remained exposed.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---