WordPress CVE-2026-119977: CISA confirms active exploitation

On 3 November 2026 CISA, the US cybersecurity agency, added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog: a time-of-check time-of-use (TOCTOU) race condition in WordPress core. It is the upgrade-process flaw fixed in WordPress 7.1.4 that we covered on 30 October, when it had no identifier yet and the only known facts were the attack attempts observed by Wordfence. Inclusion in the KEV catalog means CISA has evidence of active exploitation. On 4 November the NCSC-NL, the national cyber security centre of the Netherlands, also published an advisory on the vulnerability.

What the advisories add

According to the National Vulnerability Database (NVD) entry referenced by the KEV catalog, WordPress Core is vulnerable to remote code execution in versions 4.7 through 7.1.3. The cause is the predictable, web-accessible staging paths WordPress uses during full-package core upgrades: an unauthenticated attacker can execute code on the server while the upgrade is running.

• CVE: CVE-2026-119977, published on NVD on 31 October 2026, analysed on 4 November.
• Weakness: CWE-367 (Time-of-check Time-of-use Race Condition).
• CVSS 3.1: 8.1, high severity, assigned by Wordfence, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: network attack, high complexity, no privileges and no user interaction required, high impact on confidentiality, integrity and availability.
• Code involved: NVD’s references point, in 7.1.3, to class-core-upgrader.php, class-wp-upgrader.php and update-core.php in wp-admin/includes/, plus wp-admin/setup-config.php; the 7.1.4 fixes are in class-wp-upgrader.php and update-core.php.
• KEV catalog: added on 3 November 2026; the remediation deadline for US federal agencies is 6 November 2026. Known use in ransomware campaigns is listed as “unknown”.
• MITRE ATT&CK: T1190 (Exploit Public-Facing Application).

The available advisories do not describe the full attack chain, do not list indicators of compromise and do not say who is exploiting the flaw.

Fixed versions, branch by branch

On 30 October we only knew that the fix had been backported to older branches, down to 4.7. The NVD entry now lists the first non-vulnerable version for each branch:

• 4.x branches: 4.7.39, 4.8.34, 4.9.35;
• 5.x branches: 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20;
• 6.x branches: 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11;
• 7.x branches: 7.0.8, 7.1.4.

An installation is vulnerable if its version is lower than the one listed for its branch. NVD does not list versions earlier than 4.7.

The NCSC-NL advisory

Of NCSC-NL advisory NCSC-2026-0466, titled “Kwetsbaarheid verholpen in WordPress Core” (vulnerability fixed in WordPress Core), we could only read the title: the text was not available. The title carries the rating [L/H], which in the NCSC-NL scheme means a low likelihood of abuse (L) and high potential damage (H). The day before, CISA had recorded active exploitation: whoever sets priorities should take both into account.

Impact for European and Italian organisations

With its inclusion in the KEV catalog, the flaw moves from attempts observed by a security vendor to an exploited vulnerability recognised by a government agency: in many vulnerability management programmes that alone is enough to treat it as top priority. The attack is still only possible during a full-package upgrade, but the affected range, from 4.7 to 7.1.3, also covers old installations that nobody has updated in a long time.

For entities in scope of NIS2, handling known vulnerabilities is part of the required security measures; the compromise of an exposed site must be assessed for notification to CSIRT Italia at ACN and, if the database holds personal data, for the 72-hour notification to the data protection authority required by the GDPR. Healthcare organisations and public administrations using WordPress for bookings or online forms should start with those sites.

What to do now

1. Check the version of every WordPress installation, from the dashboard or with wp core version, including test sites and those managed by external providers, and compare it with the branch list.
2. Update to the fixed release of your branch or to 7.1.4, following the vendor’s instructions, as CISA requires. If the fix cannot be applied, CISA says to discontinue use of the product.
3. Apply the measures from our 30 October article: block web access and PHP execution in the staging folder before upgrading, search web server logs for requests to setup-config.php outside its normal path, check integrity with wp core verify-checksums.
4. If you find traces: isolate the site, preserve the logs, restore from a clean backup, change passwords, database credentials and secret keys, then assess your notification obligations.

How ARXDOME helps

ARX Expose shows which services your organisation exposes on the Internet and which products are recognised on them, including forgotten WordPress sites. ARX Shield keeps track of the open vulnerabilities on monitored machines. ARX Sentry collects logs and events from monitored servers, useful for hunting requests to the staging paths.

Last updated: 4 November 2026