CVE-2026-119977

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CVSS

8.1

EPSS

0.006 (48.8th percentile)

CISA KEV

Added 2026-11-03, due 2026-11-06

Exploitation

active

Public exploits

None seen

State

PUBLISHED

Coverage

• 

  ● Actively exploitedCritical 100The Hacker News◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record10 hours ago

  CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of…

  ↗thehackernews.com/2026/11/cisa-confirms-hackers…(opens the publisher's site in a new tab)

• ● Actively exploitedCritical 100Canadian Centre for Cyber Security◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards18 hours ago

  WordPress security advisory (AV26-1117)

  Serial number: AV26-1117 Date: November 3, 2026 As of October 31, 2026, WordPress is affected by a vulnerability in the following product: WordPress Core Prior to 7.1.4 On November 3, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to their Known Exploited…

  ↗cyber.gc.ca/en/alerts-advisories/wordpress-secu…(opens the publisher's site in a new tab)

• ● Actively exploitedCritical 100CISA advisories & alerts◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards03 Nov, 12:00

  CISA Adds One Known Exploited Vulnerability to Catalog

  CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability This type of vulnerability is a frequent attack vector for malicious…

  ↗cisa.gov/news-events/alerts/2026/11/03/cisa-add…(opens the publisher's site in a new tab)

What we observed

1. 03 Nov, 20:30kev addedcisa-kev