On Tuesday, November 3, 2026, CISA added a WordPress Core flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog. CISA describes it as a time-of-check time-of-use race condition (CWE-367) that could let an unauthenticated attacker execute code on the server during the upgrade window. The federal due date is November 6, three days after listing. The catalog marks known ransomware use as Unknown and forensic triage as Yes.
The fix has been out since October 28: WordPress 7.1.4. If your website runs on WordPress, the job this week is to confirm it is on 7.1.4, confirm who updates it, and check that nothing was added to it that you did not put there.
What happened
- October 28, 2026: WordPress released 7.1.4, a security release. Its notes list “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window” among more than a dozen fixes, most of them stored cross-site scripting bugs. WordPress recommends updating immediately.
- October 31: NVD published the record. It says WordPress Core versions 4.7 through 7.1.3 are affected, because full-package core upgrades use predictable, web-accessible staging paths. The record was submitted by Wordfence.
- November 3: CISA added the CVE to the catalog (feed version 2026.11.03), due November 6.
Why the upgrade window matters
Most bugs sit in code that is always running. This one is exposed while WordPress is upgrading itself: files are staged in a location an outsider can predict and reach over the web, and an attacker who wins the race can run code. That means the act of updating an old site is part of the exposure. It is a reason to update quickly and once, to the fixed release, rather than to leave a site unpatched.
Federal due dates bind only federal civilian agencies under BOD 26-04. For a private business they are a useful signal: CISA lists a bug only when it has evidence of exploitation, and a three-day deadline is the top of its scale.
What to do this week
- Check the version. In the WordPress dashboard, go to Dashboard, then Updates. If it shows anything below 7.1.4, click Update Now. Do this for every WordPress site you own, including old campaign or landing-page sites.
- Ask whoever runs the site. If an agency, freelancer or host manages it, ask one question in writing: is the site on WordPress 7.1.4, and on what date was it updated? Record the answer and the name of the person who gave it.
- Check automatic updates. On the Updates screen, confirm the site is set to install WordPress updates automatically, or that someone owns manual updates with a named backup. Managed hosts often control this; ask them.
- Look for admin users you do not know. Under Users, filter by Administrator. Remove or lock any account nobody can explain, and reset passwords for the rest.
- Look for files you did not add. Ask your host or developer to check the site’s files, especially PHP files in the uploads folder and the site root, for anything new or unexplained since late October. A security plugin’s file scan can do the same.
- If something looks wrong, preserve first. Take a full backup of files and database before cleaning, change all admin and hosting passwords, and ask your host for access logs.
If you want a second opinion on whether you are exposed and what to do first, our Quick Answer service covers exactly that question.
What to watch next
NVD lists the record as Deferred, so a fuller analysis may not follow. Watch the catalog row and the WordPress security announcements for changes. WordPress says its next major release, 7.2, is planned for December 8.
Sources
- CISA Known Exploited Vulnerabilities catalog JSON feed, version 2026.11.03 (CVE-2026-119977: added November 3, due November 6, ransomware use Unknown, forensic triage Yes, CWE-367)
- CISA catalog entry, CVE-2026-119977
- WordPress 7.1.4 release announcement, October 28, 2026
- NVD entry, CVE-2026-119977 (affected versions 4.7 through 7.1.3)
- BOD 26-04, Prioritizing Security Updates Based on Risk
Related: Three exploited bugs, three deadlines: Ivanti, GitLab and Cisco VPN, the previous catalog briefing, and Security and vulnerabilities, every security briefing, guide and tool in one place.