Summary
- CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on 3 November.
- The vulnerability affects temporary staging files during WordPress Core upgrades, rather than providing a continuously available attack route.
- WordPress 7.1.4 and security backports address the flaw, while earlier vulnerable upgrades may warrant investigation.
A vulnerability affecting the WordPress Core upgrade process is now confirmed to have been exploited in real-world attacks, after the US Cybersecurity and Infrastructure Security Agency added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue.
The agency added the flaw on 3 November, strengthening the evidence of malicious activity following earlier reports of widespread probing against vulnerable installations.
CVE-2026-119977 is a high-severity race condition that could allow an unauthenticated attacker to execute code on a WordPress server during a full Core upgrade. It carries a CVSS 3.1 score of 8.1 and affects vulnerable releases from the 4.7 series through version 7.1.3.
WordPress released version 7.1.4 to address the vulnerability, with fixes also backported to older release branches. NHS England has updated its security warning to reflect the confirmed exploitation and assesses further attacks as likely.
The upgrade process creates a temporary exposure
The vulnerability concerns how WordPress handles temporary staging files during a full software upgrade. These files are used while the application prepares and installs its replacement Core components.
Under vulnerable conditions, predictable and web-accessible staging paths create a short interval in which an unauthenticated attacker may be able to interfere with the upgrade process and achieve code execution.
This distinguishes the flaw from vulnerabilities that remain continuously exploitable whenever a particular version of an application is running.
The exposure depends on a vulnerable upgrade operation taking place, making timing part of the attack’s requirements. An installation that is not performing the affected operation does not necessarily expose the same immediate execution path.
However, the temporary nature of the weakness does not make successful exploitation harmless. An attacker who gains code execution during an upgrade may be able to establish persistent access that survives completion of the update.
The distinction also complicates retrospective assessment. A website may now be running a corrected WordPress version without that fact alone establishing whether an earlier upgrade was compromised.
Security company Wordfence previously reported substantial activity against the vulnerability, including tens of thousands of blocked attempts. Those observations established attacker interest and attempts to reach vulnerable systems.
CISA’s later catalogue addition provides a separate determination based on evidence of exploitation, rather than simply the presence of scanning or attempted attacks.
Confirmed exploitation changes remediation priorities
WordPress is used across corporate websites, publishing platforms, online shops, and public-sector services. Many installations are maintained through automated updates or centralised hosting arrangements.
Automation usually reduces the period during which known vulnerabilities remain unpatched. This incident demonstrates an unusual failure mode in which the maintenance operation itself can create an opportunity for attack.
The security issue is therefore not limited to checking whether an installation reports the latest version. Organisations investigating potential exposure may also need to examine previous upgrade activity, unexpected file changes, and available security records.
Such reviews are necessarily constrained by log retention and the information captured during the original operation. A lack of recorded suspicious activity does not establish that an installation could not have been targeted.
For managed hosting providers, the problem may extend across multiple customer sites using similar upgrade procedures. That shared process creates a potential concentration of exposure, although there is no evidence that all vulnerable installations were compromised.
CISA’s Known Exploited Vulnerabilities catalogue is used to prioritise flaws with established malicious exploitation. Its associated federal requirements apply to relevant US government agencies, but the catalogue also informs vulnerability management across commercial and public-sector organisations internationally.
The agency’s November listing includes a 6 November remediation date under its current federal vulnerability-management requirements.
The Canadian Centre for Cyber Security has separately confirmed the affected product range and directed administrators to available updates. NHS England recommends moving to WordPress 7.1.4 or applying the latest security fix for an older branch.
Although the upgrade-window requirement limits when the vulnerability can be exploited, successful attacks can have consequences beyond that temporary interval.
WordPress has released the relevant fixes, while CISA’s exploitation determination establishes that the issue has progressed beyond a theoretical vulnerability or isolated probing activity.
