In short: The WordPress core vulnerability CVE-2026-119977 (CVSS 8.1) is being exploited: on 3 November 2026 the US cyber agency CISA added it to its catalogue of actively exploited vulnerabilities. Versions 4.7–7.1.3 are affected; the fix is WordPress 7.1.4. Update now and check your administrator accounts.
The WordPress 7.1.4 security update of 28 October fixed 22 security issues. One of them, CVE-2026-119977, is no longer a theoretical risk: attackers are already scanning for vulnerable sites at scale. On 3 November the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its KEV catalogue (Known Exploited Vulnerabilities), which only lists flaws used in real attacks.
What is CVE-2026-119977?
- Type: a race condition (TOCTOU) in the WordPress core update process.
- Severity: CVSS 8.1, high.
- Affected versions: WordPress 4.7.0 to 7.1.3.
- Fix: WordPress 7.1.4 (28.10.2026) and patched releases for older branches (7.0.8 down to 4.7.39).
- Reported by: Picus Security researcher Umut Bayram.
How does the attack work?
When WordPress updates its core, it temporarily unpacks the new release into wp-content/upgrade. On many servers that folder can be reached from the web. An attacker who sends a request at exactly the right moment can reach the staged installer and run their own PHP code on the server – no login and no user action needed. Because the staging folder exists for only a few seconds, attackers use scripts that poll thousands of sites in a row.
How widespread are the attacks?
- More than 18,500 requests to staged installer paths were seen in the first 21 hours.
- According to Wordfence, 12,600 to 63,000 attack attempts were blocked per day (different sources and days).
- US federal agencies must fix the flaw by 6 November 2026.
No confirmed successful compromises have been reported publicly yet, but mass scanning shows that unpatched sites are a target.
What should you do now?
- Update WordPress to 7.1.4 or to the latest patched release of your branch. Check the version under Dashboard → Updates.
- Review administrator accounts. If you see an unknown user, remove it and change all passwords.
- Verify core file integrity (e.g. with
wp core verify-checksums) and look for unknown PHP files inwp-content/upgrade. - Check server logs: requests to
wp-content/upgrade/…phpare suspicious. - Ask your host or developer to block web access to
wp-content/upgrade, especially if you cannot update straight away.
If you find signs of a break-in, do not delete the evidence before it is analysed. See our hacked WordPress website repair service.
Why this matters for businesses in Estonia too
Attackers do not pick targets by country – their scripts go through every WordPress site they can find. If your website runs on WordPress and has not been updated this week, it is as exposed as any other site in the world. A hacked site can redirect visitors to scam pages, spread malware and lose Google’s trust, and with it your SEO rankings.
How to avoid this in future
Security updates should go live within days, not months. That is what WordPress maintenance is for: we watch for updates, test them with a backup and install security fixes as soon as they are released. If you only need updates, see WordPress and plugin updates. The recent PHP2Shell vulnerability showed that the server’s PHP version matters just as much.
Frequently asked questions
Is my WordPress site vulnerable to CVE-2026-119977?
Yes, if it runs WordPress 4.7–7.1.3 and has not been updated. Version 7.1.4 or the latest patched release of your branch is safe.
Will automatic updates protect me?
Minor security updates install automatically by default, but on many sites they are disabled or fail. Check your version manually.
What does the CISA KEV catalogue mean?
It is the US cyber agency’s list of vulnerabilities used in real attacks. Being added means the flaw must be fixed immediately.
What if my site has already been hacked?
Take the site offline if needed, keep a copy of the evidence, change passwords and clean the site. We help restore hacked WordPress sites.
Want to be sure your site is updated and secure? Get a free website audit or contact us.
