WordPress Core RCE flaw CVE-2026-119977 added to CISA KEV

CISA added a WordPress Core remote code execution flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-03, according to the CISA KEV entry. The bug lets unauthenticated attackers run code on the server during a core upgrade, and federal agencies must act by 2026-11-06. If you run WordPress, treat this as a same-day patching job.

What happened

CISA classes the issue as a time-of-check time-of-use (TOCTOU) race condition in WordPress Core. The upgrade routine for full-package core updates uses predictable staging paths that can be reached over the web. An attacker who knows where the files land can interfere with the upgrade and execute code on the server while the upgrade is running.

NVD published the record on 2026-10-31 and scores it CVSS 8.1 (High). CISA’s listing means it has evidence of exploitation. It has not said who is exploiting the flaw, and it lists use in ransomware campaigns as unknown.

Am I affected?

Per the NVD description, WordPress Core versions 4.7 through 7.1.3 are affected. That is a very wide range, so assume any self-managed WordPress site is in scope until you check its version.

• Sites on 4.7 to 7.1.3: affected.
• Managed hosts that patch core for you: ask the provider whether the update has been applied.
• Risk is concentrated in the upgrade window, so sites that run automatic or full-package updates deserve particular attention.

NVD does not record a fixed-version field. Its references include a WordPress release announcement, so check that release first.

Technical details

• Weakness: CWE-367, time-of-check time-of-use race condition.
• CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. It is network-reachable and needs no privileges or user interaction, but attack complexity is high because the attacker must hit the upgrade window.
• EPSS: 0.006, a low predicted probability of exploitation, which sits oddly beside the confirmed KEV listing. Treat KEV as the stronger signal.
• KEV: added 2026-11-03, due 2026-11-06. CISA’s required action is to apply vendor mitigations and follow its BOD 26-04 guidance, or stop using the product if mitigations are unavailable.

Wordfence has published its own threat-intelligence entry for the same flaw.

Why this matters

Analysis, not new facts: the high attack complexity limits how easily this can be used at scale, and that probably explains the low EPSS. But CISA has still confirmed exploitation, and WordPress Core sits on a huge number of internet-facing servers. Code execution on the web server usually means access to the site database, configuration secrets and any other sites sharing the host. Because KEV listing means exploitation is already happening, aim to patch within hours rather than the normal maintenance cycle.

What to do

1. Inventory every WordPress install, including staging, forgotten and client sites, and record each core version.
2. Update anything on 7.1.3 or earlier to the latest WordPress release, starting with the release announcement linked above.
3. Avoid starting core upgrades on exposed sites until they are patched; where possible, run upgrades with web access to the site restricted.
4. Confirm with managed hosts and hosting providers that they have applied the update.
5. Hunt for compromise: review web server logs for unexpected requests to upgrade or staging directories under the WordPress install, and look for new files, new administrator accounts or modified core files around past upgrade times. CISA also references forensic triage requirements in its required action.
6. Tell your incident response and hosting contacts, and record the patch date to show you met the 2026-11-06 deadline if you are bound by BOD 26-04.

The vendor has not published, any workaround other than updating. If you cannot patch, CISA’s guidance is to apply the vendor’s mitigations or discontinue use of the product.

Related coverage

• Bricksforge WordPress plugin flaw exploited for RCE (CVE-2026-85097)
• Zammad session fixation and root privilege escalation flaws added to CISA KEV (CVE-2026-102489, CVE-2026-102490)
• Linux kernel CVE-2026-46300 added to CISA KEV, exploited

Sources

• NVD: CVE-2026-119977
• CISA KEV catalog entry
• WordPress release announcement
• Wordfence threat intelligence entry
• FIRST EPSS data for CVE-2026-119977