CISA now lists the WordPress update bug as exploited. Patch, then check your last update

On Monday we flagged scanners polling for the WordPress update bug. On Tuesday CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies until Friday, November 6, three days after the listing.

The listing also asks agencies to check whether a site was broken into before it was patched. That second step is the useful one for everyone else.

CISA now says the WordPress update bug is exploited. Patching closes it; it does not tell you whether someone got in during an earlier update.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

CISA now lists the WordPress update bug as exploited

CISA’s November 3 alert lists CVE-2026-119977, a time-of-check time-of-use race in WordPress Core. Its catalog entry says unauthenticated attackers could run code on the server during the upgrade window because full-package core upgrades used predictable, web-reachable staging paths. Ransomware use is marked unknown.

The entry is flagged “forensic triage required” under CISA’s Binding Operational Directive 26-04. CISA did not publish the evidence behind the listing.

Sites that ran a full core update before 7.1.4

Versions 4.7 through 7.1.3 are affected. A site was exposed only while it was unpacking a full core update with wp-content/upgrade/ served over the web, but most sites run those updates automatically, so few owners know when the window opened.

Rescana notes that the update to 7.1.4 is itself unpacked by the old code, which makes that last update one more window. Sites that updated after October 28 should check that window too.

Confirm 7.1.4, then look back at your last update

• Run wp core version on every site and confirm 7.1.4 or its branch release, down to 4.7.39 on the oldest branch.
• Run wp core verify-checksums to catch changed core files.
• Keep web access to wp-content/upgrade/ blocked at the server for future updates.
• Federal agencies: the listing marks forensic triage as required, so keep a record of what you checked on each site.

Details

• CVE-2026-119977: WordPress Core 4.7 to 7.1.3, upgrade-window remote code execution through predictable staging paths (CWE-367). CVE record published October 31 by Wordfence as CNA.
• KEV: added November 3, 2026; federal due date November 6, 2026; forensic triage required under BOD 26-04; ransomware use unknown.
• Fixed: 7.1.4 (October 28), with security releases for older branches back to 4.7.39 (WordPress.org).

Hunt / verify

• In access logs around each core update since October 28, look for requests to wp-content/upgrade/ paths that end in setup-config.php, and treat any that returned 200 as a lead.
• List administrators with wp user list --role=administrator, and look for PHP files under wp-content/uploads/ or new mu-plugins created in the same period.

Source: CISA KEV alert, November 3; WordPress 7.1.4 release

Sources

• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (November 3, 2026)
• CISA: Known Exploited Vulnerabilities Catalog
• WordPress.org: WordPress 7.1.4
• Rescana: WordPress 7.1.4 Upgrade-Window Race RCE (CVE-2026-119977)
• CVE.org: CVE-2026-119977
• NVD: CVE-2026-119977

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].