CISA added WordPress Core flaw CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 3 November, giving federal civilian agencies until 6 November to apply mitigations and requiring forensic triage.
CISA’s catalog entry describes a time-of-check time-of-use race condition that “could allow unauthenticated attackers to execute code on the server during the upgrade window.” The cause, in CISA’s words, is “predictable, web-accessible staging paths used during full-package core upgrades.” The catalog lists the flaw under CWE-367 and marks known ransomware campaign use as unknown.
The fix shipped in WordPress 7.1.4 on 28 October. The release notes list “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window,” reported by Umut Bayram, among a set of stored cross-site scripting fixes. WordPress calls it a security release and recommends updating immediately. Sites that support automatic background updates will start the update on their own.
The exposure sits in the upgrade itself: CISA ties it to staging paths used during full-package core upgrades, so the window opens whenever a site runs one. We covered an earlier case where a WordPress core bug needed no login to exploit, and this one also needs no account on the target.
The catalog’s required action also points to CISA’s forensic triage requirements, and the entry marks forensic triage as “Yes.” In our reading, that means a site that ran a full-package core upgrade before 7.1.4 needs a check for tampering as well as the patch. A second content management flaw is in the same position: Drupal Commerce Core CVE-2026-118539 is under active exploitation.
Update to 7.1.4 or later, confirm the version on every site you host or manage, and review core upgrades run before the fix. Federal agencies have the 6 November date; everyone else can use it as a practical deadline.
