CISA’s WordPress upgrade-window deadline is today. Confirm 7.1.4 and check the last Core update

Today, November 6, is the CISA KEV due date for CVE-2026-119977, the WordPress Core upgrade-window race we covered on November 2 and again when CISA listed it on November 4. Federal civilian agencies must remediate by end of day under BOD 26-04, with forensic triage flagged.

The practical check for everyone else is the same: every site on 4.7 through 7.1.3 needs 7.1.4 or the matching branch release, and anyone who ran a full-package core upgrade while scanners were active should review that window’s web logs.

CISA’s WordPress deadline is today. If any site is still below 7.1.4, finish the upgrade and look at the last core-update logs before you close the ticket.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Federal WordPress deadline is today

CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities catalog on November 3 and set the remediation due date to November 6. The catalog entry describes a TOCTOU race in full-package core upgrades that used predictable, web-accessible staging paths, letting unauthenticated attackers run code during the upgrade window.

WordPress 7.1.4 and the matching updates for earlier branches shipped on October 28. Wordfence and others tracked tens of thousands of exploitation attempts before the KEV listing. CISA marks ransomware use as unknown and requires forensic triage under BOD 26-04 for federal agencies.

Sites still below 7.1.4 during an upgrade window

A KEV due date does not create new technical risk by itself, but it is the day federal teams have to show the fix, and it is the day scanners expect laggards to still be unpatched. Shared hosts and agencies that batch WordPress updates at the end of the week are the ones who miss this.

The bug only helps an attacker during an upgrade window, so the forensic question is narrow: did this site run a full-package core update after mid-October, and did anything hit the staging paths while it did?

Confirm 7.1.4, then check the last upgrade logs

• On every WordPress site, confirm the version is 7.1.4 or the patched build for that branch (wp-admin → Updates, or wp core version).
• If a site is still on 7.1.3 or older, update Core now, then update plugins and themes.
• For sites that ran a full-package core upgrade since mid-October, review web logs around that timestamp for requests to staging or upgrade paths under wp-admin/includes and the upgrade temp directories WordPress used.
• Federal and BOD 26-04-scoped teams: complete the forensic triage steps CISA lists for this KEV entry and record the remediation date.

Details

• CVE-2026-119977: WordPress Core 4.7.0–7.1.3, unauthenticated upgrade-window RCE via predictable staging paths (CWE-367). CVSS 8.1 high.
• Fixed: WordPress 7.1.4 and matching branch releases (October 28, 2026).
• KEV: added November 3, 2026; due November 6, 2026; forensic triage: Yes; ransomware use: Unknown.
• Earlier coverage: November 2 scanning wave; November 4 KEV listing.

Hunt / verify

• Inventory versions: wp core version across hosts, or the site health / updates screen.
• In web logs, search for requests to upgrade staging paths around each site’s last Core update timestamp.
• Flag any site that still reports 7.1.3 or older in external scans.

Source: WordPress 7.1.4 release; Our Nov 4 KEV card

Sources

• WordPress 7.1.4 release notes
• CISA Known Exploited Vulnerabilities Catalog
• CyberExperts: November 4 WordPress KEV forensic check
• CyberExperts: November 2 WordPress upgrade-window attacks
• CVE.org: CVE-2026-119977
• NVD: CVE-2026-119977

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].