CISA says attackers are exploiting WordPress flaw that lets them run code during updates

What happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026. The flaw is in WordPress core, the main software of the WordPress website platform. CISA said in its alert that it added the flaw based on evidence of active exploitation. To be added to the KEV catalog, a flaw must have a CVE ID, evidence of exploitation, and clear guidance on how to fix it, according to CISA.

CISA describes the flaw as a time-of-check time-of-use (TOCTOU) race condition, a timing flaw. CISA said it "could allow unauthenticated attackers to execute code on the server during the upgrade window." That means someone without an account on a site could run their own code on its web server, but only while WordPress is installing a full update of its core software.

WordPress fixed the flaw in version 7.1.4, released on October 28, 2026, and credited researcher Umut Bayram with reporting it, according to the WordPress release announcement. The flaw carries a severity score of 8.1 out of 10, rated high, The Hacker News reported.

Who is affected

The flaw affects WordPress core versions 4.7 through 7.1.3, according to The Hacker News and the flaw's CVE record. WordPress ran on 39.5% of all websites as of November 4, 2026, according to the web technology survey firm W3Techs.

The WordPress security company Wordfence said an attack requires the attacker "to hit a very narrow window while wordpress is unpacking a complete core update," The Hacker News reported. In normal lab environments the window has lasted only seconds, according to The Hacker News. Wordfence said the folder WordPress uses to hold the new files during these updates can be reached from the web on many servers.

Attack activity

In the first 21 hours after the flaw was disclosed, Wordfence recorded more than 18,500 requests aimed at the WordPress installer files involved in the attack, The Hacker News reported. On October 30, Wordfence said it had blocked 62,969 attacks targeting the flaw over the previous 24 hours.

"Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window," said Alex Thomas, who leads the Wordfence Threat Response Team, according to The Hacker News.

The security firm Previdian recorded three exploitation attempts against its honeypots, decoy systems set up to attract attackers, on October 30, 2026, from an IP address located in the U.K., The Hacker News reported. CISA's catalog entry lists whether the flaw has been used in ransomware campaigns as unknown.

What site owners should do

CISA gave U.S. federal civilian agencies until November 6, 2026, to apply WordPress's fixes. Its catalog entry also points agencies to CISA's forensics triage requirements under Binding Operational Directive (BOD) 26-04. That directive sets out when agencies must check whether attackers compromised a system before the patch was applied. CISA encourages all organizations to prioritize fixing flaws listed in the KEV catalog.

WordPress recommends that site owners update immediately, either from the WordPress dashboard or by downloading version 7.1.4 from WordPress.org. On sites that support automatic background updates, the update begins automatically, according to the release announcement. WordPress said it was backporting the security fixes to every older branch still eligible for security fixes, back to version 4.7, and that only the most recent version is actively supported.

According to The Hacker News, site owners are advised to update to version 7.1.4 as soon as possible. They should also look for suspicious requests to PHP files in WordPress's temporary upgrade folder, and for unfamiliar administrator accounts, plugins, or PHP files.