Skip to content
securitytabs

LiveUpdated

CISA Says Attackers Are Exploiting a WordPress Core Flaw During Software Upgrades

A flaw in the core WordPress software that runs a large share of websites is being used in attacks, and it could let an attacker run their own code on a site. Site owners should update to the fixed version now.

WordPress core race condition flaw exploited in attacks
WordPress core race condition flaw exploited in attacks

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

On November 3, CISA added CVE-2026-119977, a flaw in WordPress Core, to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, citing evidence of active exploitation. CISA describes it as a time-of-check time-of-use race condition, a timing weakness where a check is made and the result changes before it is acted on. [1][2]

The flaw can lead to arbitrary code execution, meaning an attacker can run their own commands on the site. Security Affairs describes it as a remote code execution flaw affecting WordPress versions 4.7 through 7.1.3, and The Hacker News says it is exploited during software upgrades. [2][3]

Severity and fix

The CVE record lists a CVSS score of 8.1, and FIRST's EPSS estimate was 0.006 on November 3. A Canadian government advisory lists WordPress Core versions prior to 7.1.4 as affected, indicating 7.1.4 contains the fix. [2][4]

CISA set a federal due date of November 6 for agencies to apply fixes under Binding Operational Directive 26-04. Whether the flaw has been used in ransomware attacks is listed as unknown. [1]

What is not yet known

The available sources do not say who is exploiting the flaw, how many sites have been hit, or which sites are exposed in practice. [1][2][3]

Timeline

  1. A Canadian government advisory listed WordPress Core versions prior to 7.1.4 as affected. [4]

  2. CISA set a federal remediation due date of November 6. [1]

  3. CISA added the WordPress Core flaw to its Known Exploited Vulnerabilities catalogue. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Sites running WordPress Core before 7.1.4 are affected, and CISA says the flaw is being exploited. [1][4]

What to do

  1. Update WordPress to version 7.1.4 or later, or ask your hosting provider to do so. [4]
  2. Ask your host or web agency whether your sites have been updated. [1]

Mid-size company

A small IT or security team

What to know

CISA's federal due date of November 6 signals the urgency. Affected versions run from 4.7 through 7.1.3. [1][3]

What to do

  1. Inventory WordPress installations, including forgotten or staging sites, and check their versions. [3]
  2. Update affected sites to 7.1.4 or later. [4]

Large enterprise

A security operations team

What to know

The reported exploitation happens during software upgrades, so sites with automated or staged upgrade processes deserve attention. [2]

What to do

  1. Inventory WordPress deployments, including those run by third parties and agencies, and prioritize updating to 7.1.4 or later. [4][1]
  2. Review web server activity around recent upgrades on affected sites for unexpected changes. [2]

Sources

  1. [1]CISA Advisories · Nov 3, 12:00 UTC
    CISA Adds One Known Exploited Vulnerability to Catalogcontext
  2. [2]The Hacker News · Nov 4, 05:43 UTC
    CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgradescontext
  3. [3]Security Affairs · Nov 4, 09:16 UTC
    U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalogcontext
  4. [4]Canadian Centre for Cyber Security · Nov 3, 21:36 UTC
    WordPress security advisory (AV26-1117)context