US Cyber Agency Says a WordPress Flaw Fixed in October Is Now Being Exploited
The US Cybersecurity and Infrastructure Security Agency has added a flaw in WordPress core to its catalog of vulnerabilities that attackers are already using. CISA published the addition on Nov. 3, 2026, and said it was made "based on evidence of active exploitation." A fix for the flaw, CVE-2026-119977, has been available since Oct. 28, 2026.
For anyone who runs a WordPress site, the detail to act on is the version number. The CVE record lists versions 4.7 through 7.1.3 as affected and puts the fix in WordPress 7.1.4. Neither CISA's alert nor that record gives any figure for how many sites have been attacked.
The record, assigned by the security firm Wordfence, describes the problem as a race condition, a timing flaw, in WordPress's own upgrade process. It rates the flaw high severity and says it could let an attacker with no account on the site run code on the server during an upgrade. It credits Umut Bayram with finding it and dates the disclosure to the same day the fix shipped.
For US federal civilian agencies, the listing starts a clock. CISA's catalog entry sets Nov. 6, 2026, as the date by which they must apply the vendor's fix or, where no fix is available, stop using the product, under Binding Operational Directive 26-04. The agency's alert says that directive requires agencies to "prioritize rapid remediation of high-risk vulnerabilities" listed in the catalog on publicly exposed systems that give an attacker total control, and that it sets expectations for when they must also check whether the system was broken into before the patch went on. CISA says it encourages every organization, not only federal ones, to prioritize catalog entries the same way.
WordPress's release note for version 7.1.4 calls it a security release, recommends updating sites immediately, and lists a weakness in the upgrade process among the issues fixed. The project says the security fixes were backported to every older branch still eligible to receive them, and that those backports were in progress when the release went out.
