# WordPress: patch the exploited core upgrade flaw Canonical: https://www.oktsec.com/radar/wordpress-core-cve-2026-119977 Publisher: Oktsec Language: en Published: 2026-11-03T22:13:58Z Updated: 2026-11-03T22:13:58Z Record reviewed: 2026-11-03T22:13:58Z Latest evidence check: 2026-11-03T22:13:58Z Disclosed: 2026-10-28 CISA lists CVE-2026-119977 as exploited: affected WordPress core upgrades can expose a brief path to unauthenticated code execution. Install a corrected release for the deployed branch and review earlier upgrade activity. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: CISA added this CVE to KEV on November 3. Exploitation depends on the full-package core upgrade window and reachable staging files; it does not establish compromise of every WordPress site. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: WordPress - Products: WordPress Core - CVEs: CVE-2026-119977 - Vendor severity: CVSS 3.1 8.1 ## Technical overview The flaw is in the WordPress core upgrade process, not a plugin. During a full-package upgrade, predictable staging paths can be reached over the web before the upgrade completes, allowing an unauthenticated attacker to race that process and execute code. WordPress published the correction on October 28. The current-branch fix is 7.1.4; earlier branches received separate backports. Use the affected-version table for the installed branch rather than applying a single “below 7.1.4” rule. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3. This establishes known exploitation of the CVE, not compromise of a particular website. A site that is patched now may still require investigation of earlier upgrade windows. ## Recommended response Install WordPress 7.1.4 or a corrected release for your branch. Verify each deployed site and investigate suspicious activity around earlier core upgrades. Relevant to: Teams operating WordPress websites, managed hosting platforms and automated core-update pipelines. ## CVE attribution - CVE-2026-119977: WordPress — WordPress Core; CVSS 3.1: 8.1. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119977.json) ## Affected systems and fixes ### WordPress Core 7.1 Affected: 7.1.0 through 7.1.3 Fixed release / action: 7.1.4 ### WordPress Core 7.0 Affected: 7.0.0 through 7.0.7 Fixed release / action: 7.0.8 ### WordPress Core 6.9 Affected: 6.9.0 through 6.9.10 Fixed release / action: 6.9.11 ### WordPress Core 6.8 Affected: 6.8.0 through 6.8.11 Fixed release / action: 6.8.12 ### WordPress Core 6.7 Affected: 6.7.0 through 6.7.10 Fixed release / action: 6.7.11 ### WordPress Core 6.6 Affected: 6.6.0 through 6.6.10 Fixed release / action: 6.6.11 ### WordPress Core 6.5 Affected: 6.5.0 through 6.5.13 Fixed release / action: 6.5.14 ### WordPress Core 6.4 Affected: 6.4.0 through 6.4.13 Fixed release / action: 6.4.14 ### WordPress Core 6.3 Affected: 6.3.0 through 6.3.13 Fixed release / action: 6.3.14 ### WordPress Core 6.2 Affected: 6.2.0 through 6.2.14 Fixed release / action: 6.2.15 ### WordPress Core 6.1 Affected: 6.1.0 through 6.1.15 Fixed release / action: 6.1.16 ### WordPress Core 6.0 Affected: 6.0.0 through 6.0.17 Fixed release / action: 6.0.18 ### WordPress Core 5.9 Affected: 5.9.0 through 5.9.19 Fixed release / action: 5.9.20 ### WordPress Core 5.8 Affected: 5.8.0 through 5.8.18 Fixed release / action: 5.8.19 ### WordPress Core 5.7 Affected: 5.7.0 through 5.7.20 Fixed release / action: 5.7.21 ### WordPress Core 5.6 Affected: 5.6.0 through 5.6.22 Fixed release / action: 5.6.23 ### WordPress Core 5.5 Affected: 5.5.0 through 5.5.23 Fixed release / action: 5.5.24 ### WordPress Core 5.4 Affected: 5.4.0 through 5.4.24 Fixed release / action: 5.4.25 ### WordPress Core 5.3 Affected: 5.3.0 through 5.3.26 Fixed release / action: 5.3.27 ### WordPress Core 5.2 Affected: 5.2.0 through 5.2.29 Fixed release / action: 5.2.30 ### WordPress Core 5.1 Affected: 5.1.0 through 5.1.27 Fixed release / action: 5.1.28 ### WordPress Core 5.0 Affected: 5.0.0 through 5.0.30 Fixed release / action: 5.0.31 ### WordPress Core 4.9 Affected: 4.9.0 through 4.9.34 Fixed release / action: 4.9.35 ### WordPress Core 4.8 Affected: 4.8.0 through 4.8.33 Fixed release / action: 4.8.34 ### WordPress Core 4.7 Affected: 4.7.0 through 4.7.38 Fixed release / action: 4.7.39 Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.03 Checked: 2026-11-03T22:13:58Z ### [CVE-2026-119977](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977) - Added: 2026-11-03 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-06 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-10-27T15:30:57.206Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-119977 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-10-27T15:30:57.206Z. ## Response checklist 1. **Inventory sites and update mechanisms** — Record the running core version and branch for each website. Include managed hosting and automated deployments; confirm their installed fixes with the responsible provider. 2. **Install the correction for the deployed branch** — Use WordPress 7.1.4 or the applicable patched branch release listed in the version table. Older branches have backports; a version below 7.1.4 is not automatically vulnerable. Follow the supported update process and verify the resulting version. 3. **Review activity around previous core upgrades** — Preserve relevant web-server and deployment logs. Review unexpected requests to upgrade staging files, unrecognized PHP files and unauthorized changes around update times. A successful patch does not establish that earlier upgrades were uncompromised. 4. **Escalate confirmed signs of compromise** — If investigation finds unauthorized access, contain the affected site and assess the host, data and reachable credentials through incident response. Record evidence gaps; do not treat blocked requests as confirmed victims. ## Relevance to AI environments Include sites updated by deployment agents or automation in the inventory. Review credentials reachable from a compromised web server if investigation finds unauthorized access. ## Sources - [WordPress 7.1.4 security release](https://wordpress.org/news/2026/10/wordpress-7-1-4/) — WordPress; Vendor notice; checked 2026-11-03T22:13:58Z - [Wordfence: affected branches and corrected releases](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution) — Wordfence; Research report; checked 2026-11-03T22:13:58Z - [Wordfence CNA: CVE-2026-119977 branch ranges](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/119xxx/CVE-2026-119977.json) — Wordfence / CVE Program; Research report; checked 2026-11-03T22:13:58Z - [CISA KEV: CVE-2026-119977 added November 3](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-03T22:13:58Z ## Editorial record - 2026-11-03T22:13:58Z: Added the November 3 KEV entry, upgrade-window scope, branch-specific fixes and a response checklist. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/wordpress-core-cve-2026-119977) · [Build a response plan](https://www.oktsec.com/radar/wordpress-core-cve-2026-119977#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=wordpress-core-cve-2026-119977&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=wordpress-core-cve-2026-119977&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.