The Cybersecurity and Infrastructure Security Agency added a WordPress core vulnerability, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog on Tuesday, November 3, confirming that attackers have started exploiting it in the wild, according to BleepingComputer. Federal civilian agencies must secure their systems by Friday, November 6, under Binding Operational Directive 26-04. A fix is already available in WordPress 7.1.4, which the WordPress security team released on October 28.
The high-severity flaw is a time-of-check to time-of-use race condition, reported by Picus Security researcher Umut Bayram. According to the report, successful exploitation can let remote attackers without privileges execute code on the server in high-complexity attacks, because of predictable, web-accessible staging paths used during full-package core upgrades.
The WordPress security team described the issue as a weakness in the upgrade process that can lead to remote code execution during the upgrade window, and recommended that site owners update immediately because this is a security release. Because the exposure is tied to the upgrade process itself, sites that have already moved to 7.1.4 are protected.
CISA said this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Although the directive applies only to federal agencies, CISA urged all network defenders, including those in the private sector, to prioritize patching. That guidance extends the urgency to agencies, publishers, small businesses and anyone else running a WordPress site.
WordPress security firm Wordfence said in an advisory update over the weekend that it blocked 13,095 attacks targeting the vulnerability in the past 24 hours. CISA has not provided further details on the attacks, and more information is expected as the agency and security vendors continue their work.
The listing follows a busy year for WordPress core security. In July, the WordPress security team patched a critical vulnerability chain in core known as wp2shell, which could be abused to deploy webshells and take over unpatched servers. The chain combined a REST API batch-route confusion flaw, CVE-2026-63030, with an SQL injection flaw, CVE-2026-60137. Public exploits were released one day after the patches went live, and attackers began breaching unpatched servers within days to deploy persistent webshells and install malicious plugins.
BleepingComputer also reports that a Chinese-speaking threat actor weaponized the wp2shell exploit chain in September to steal sensitive data, including more than 18,500 records stored in backend databases belonging to small businesses and government organizations. The pattern is consistent: once a fix ships, attackers move quickly against sites that have not applied it, which makes the gap between release and update the period that matters most.
The timeline offers a useful benchmark for patch management. The fix shipped on October 28, the listing arrived on November 3, and the federal deadline falls on November 6, a window of only a few days from catalog entry to required remediation. Binding Operational Directive 26-04 sets that clock for federal civilian agencies, and many private organizations borrow it as a planning guide because CISA adds a vulnerability to the catalog only when there is evidence of real exploitation. When a flaw reaches that list, the question is no longer whether attackers might use it, but whether a given site has already been touched.
For site owners and agencies, the action list is short. Update to WordPress 7.1.4, confirm that automatic background updates are enabled, and check with the hosting provider, since managed WordPress platforms may have applied protections already. Teams that manage many sites can use the CISA listing as a prompt to verify the version on every installation, including staging and legacy sites that are easy to overlook.
The speed of the fix is a positive. WordPress released a patch on October 28, several days before CISA’s listing, so site owners who keep automatic updates on were covered before exploitation was confirmed. For everyone else, the path to safety is a single update.
Leave a Reply