Alertas prioritarias y resúmenes de Radar por correo.
Comprobando disponibilidad…
Aviso de seguridad
CISA lists CVE-2026-119977 as exploited: affected WordPress core upgrades can expose a brief path to unauthenticated code execution. Install a corrected release for the deployed branch and review earlier upgrade activity.
Quiénes deben revisar: Teams operating WordPress websites, managed hosting platforms and automated core-update pipelines.
Acción recomendadaCorrección disponible
Install WordPress 7.1.4 or a corrected release for your branch. Verify each deployed site and investigate suspicious activity around earlier core upgrades.
The flaw is in the WordPress core upgrade process, not a plugin. During a full-package upgrade, predictable staging paths can be reached over the web before the upgrade completes, allowing an unauthenticated attacker to race that process and execute code.
WordPress published the correction on October 28. The current-branch fix is 7.1.4; earlier branches received separate backports. Use the affected-version table for the installed branch rather than applying a single “below 7.1.4” rule.
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3. This establishes known exploitation of the CVE, not compromise of a particular website. A site that is patched now may still require investigation of earlier upgrade windows.
Proveedor / autor
WordPress
Identificadores de vulnerabilidad
CVE-2026-119977
Acceso necesario
Depende de la aplicación o configuración
Severidad del proveedor
8.1 · CVSS 3.1
Divulgado
28 oct 2026
Última revisión de evidencia
3 nov 2026 UTC
¿Qué sistemas y versiones están afectados?
Producto
Afectado
Versión corregida / acción
WordPress Core 7.1
7.1.0 through 7.1.3
7.1.4
WordPress Core 7.0
7.0.0 through 7.0.7
7.0.8
WordPress Core 6.9
6.9.0 through 6.9.10
6.9.11
WordPress Core 6.8
6.8.0 through 6.8.11
6.8.12
WordPress Core 6.7
6.7.0 through 6.7.10
6.7.11
WordPress Core 6.6
6.6.0 through 6.6.10
6.6.11
WordPress Core 6.5
6.5.0 through 6.5.13
6.5.14
WordPress Core 6.4
6.4.0 through 6.4.13
6.4.14
WordPress Core 6.3
6.3.0 through 6.3.13
6.3.14
WordPress Core 6.2
6.2.0 through 6.2.14
6.2.15
WordPress Core 6.1
6.1.0 through 6.1.15
6.1.16
WordPress Core 6.0
6.0.0 through 6.0.17
6.0.18
WordPress Core 5.9
5.9.0 through 5.9.19
5.9.20
WordPress Core 5.8
5.8.0 through 5.8.18
5.8.19
WordPress Core 5.7
5.7.0 through 5.7.20
5.7.21
WordPress Core 5.6
5.6.0 through 5.6.22
5.6.23
WordPress Core 5.5
5.5.0 through 5.5.23
5.5.24
WordPress Core 5.4
5.4.0 through 5.4.24
5.4.25
WordPress Core 5.3
5.3.0 through 5.3.26
5.3.27
WordPress Core 5.2
5.2.0 through 5.2.29
5.2.30
WordPress Core 5.1
5.1.0 through 5.1.27
5.1.28
WordPress Core 5.0
5.0.0 through 5.0.30
5.0.31
WordPress Core 4.9
4.9.0 through 4.9.34
4.9.35
WordPress Core 4.8
4.8.0 through 4.8.33
4.8.34
WordPress Core 4.7
4.7.0 through 4.7.38
4.7.39
Usá las indicaciones para tu producto y rama. Confirmá con el proveedor las correcciones adaptadas a tu distribución; el nombre del producto por sí solo no establece exposición.
CISA added this CVE to KEV on November 3. Exploitation depends on the full-package core upgrade window and reachable staging files; it does not establish compromise of every WordPress site.
¿Qué implica para los entornos de IA?
Include sites updated by deployment agents or automation in the inventory. Review credentials reachable from a compromised web server if investigation finds unauthorized access.
Added the November 3 KEV entry, upgrade-window scope, branch-specific fixes and a response checklist.
Acciones de respuesta
Prepará tu respuesta
0 de 4 acciones registradas como completadas
Usá esta lista para evaluar si el aviso afecta a tus sistemas, registrar las acciones de tu equipo y compartir el resultado. Radar no escanea ni verifica tu entorno.
Los cambios se guardan automáticamente en este navegador. No se sincronizan con tu equipo ni se envían a Oktsec.
Indicá el sistema y la persona o equipo responsable. Actualizá cada acción y agregá una referencia al ticket o notas sobre lo revisado.
1
Inventory sites and update mechanisms
Record the running core version and branch for each website. Include managed hosting and automated deployments; confirm their installed fixes with the responsible provider.
Agregar evidencia o notasUsá solo referencias. No guardes credenciales ni datos confidenciales acá.
2
Install the correction for the deployed branch
Use WordPress 7.1.4 or the applicable patched branch release listed in the version table. Older branches have backports; a version below 7.1.4 is not automatically vulnerable. Follow the supported update process and verify the resulting version.
Agregar evidencia o notasUsá solo referencias. No guardes credenciales ni datos confidenciales acá.
3
Review activity around previous core upgrades
Preserve relevant web-server and deployment logs. Review unexpected requests to upgrade staging files, unrecognized PHP files and unauthorized changes around update times. A successful patch does not establish that earlier upgrades were uncompromised.
Agregar evidencia o notasUsá solo referencias. No guardes credenciales ni datos confidenciales acá.
4
Escalate confirmed signs of compromise
If investigation finds unauthorized access, contain the affected site and assess the host, data and reachable credentials through incident response. Record evidence gaps; do not treat blocked requests as confirmed victims.
Agregar evidencia o notasUsá solo referencias. No guardes credenciales ni datos confidenciales acá.
3. Compartí el plan
Descargá un archivo Markdown con tu decisión, los estados de las acciones, las notas y las fuentes. Compartilo con tu equipo o adjuntalo a un ticket.
Compará la versión en ejecución y la configuración con las indicaciones del proveedor.
Producto
Afectado
Versión corregida / acción
WordPress Core 7.1
7.1.0 through 7.1.3
7.1.4
WordPress Core 7.0
7.0.0 through 7.0.7
7.0.8
WordPress Core 6.9
6.9.0 through 6.9.10
6.9.11
WordPress Core 6.8
6.8.0 through 6.8.11
6.8.12
WordPress Core 6.7
6.7.0 through 6.7.10
6.7.11
WordPress Core 6.6
6.6.0 through 6.6.10
6.6.11
WordPress Core 6.5
6.5.0 through 6.5.13
6.5.14
WordPress Core 6.4
6.4.0 through 6.4.13
6.4.14
WordPress Core 6.3
6.3.0 through 6.3.13
6.3.14
WordPress Core 6.2
6.2.0 through 6.2.14
6.2.15
WordPress Core 6.1
6.1.0 through 6.1.15
6.1.16
WordPress Core 6.0
6.0.0 through 6.0.17
6.0.18
WordPress Core 5.9
5.9.0 through 5.9.19
5.9.20
WordPress Core 5.8
5.8.0 through 5.8.18
5.8.19
WordPress Core 5.7
5.7.0 through 5.7.20
5.7.21
WordPress Core 5.6
5.6.0 through 5.6.22
5.6.23
WordPress Core 5.5
5.5.0 through 5.5.23
5.5.24
WordPress Core 5.4
5.4.0 through 5.4.24
5.4.25
WordPress Core 5.3
5.3.0 through 5.3.26
5.3.27
WordPress Core 5.2
5.2.0 through 5.2.29
5.2.30
WordPress Core 5.1
5.1.0 through 5.1.27
5.1.28
WordPress Core 5.0
5.0.0 through 5.0.30
5.0.31
WordPress Core 4.9
4.9.0 through 4.9.34
4.9.35
WordPress Core 4.8
4.8.0 through 4.8.33
4.8.34
WordPress Core 4.7
4.7.0 through 4.7.38
4.7.39
Confirmá con el proveedor las correcciones adaptadas a tu distribución. Coincidir en el producto no basta para establecer exposición.
Acceso necesarioDepende de la aplicación o configuración
EVIDENCIA CON FUENTES
Evidencia y fuentes
Revisado 3 nov 2026 UTC
Por qué tiene esta prioridad
CISA added this CVE to KEV on November 3. Exploitation depends on the full-package core upgrade window and reachable staging files; it does not establish compromise of every WordPress site.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Los plazos y requisitos federales de CISA se muestran como contexto. No son obligaciones universales para empresas privadas o de América Latina. La fecha de incorporación corresponde al catálogo, no al primer ataque.
Evidencia de respaldo
Producto / CVE
Evidencia de ataques
Indicaciones de la fuente
WordPress CoreCVE-2026-119977
Ataques confirmados
Confirmado por CISA, la agencia de ciberseguridad de EE. UU.
Estimación no disponible. No equivale a un puntaje de cero.
FIRST EPSS · Revisado 2026-10-27 15:30 UTC
La prioridad corresponde al aviso, no a cada producto o CVE por separado. Cada fila muestra solo la evidencia atribuida a ese CVE. La falta de evidencia de ataques no permite descartar una vulnerabilidad. Tu entorno no fue escaneado.
Fuentes
Los datos técnicos provienen de estas fuentes. Las prioridades y las acciones recomendadas son el análisis de Oktsec.
Include sites updated by deployment agents or automation in the inventory. Review credentials reachable from a compromised web server if investigation finds unauthorized access.