CISA Gives Agencies Three Days to Patch Exploited WordPress Flaw

CISA added CVE-2026-119977, the WordPress Core upgrade flaw patched on October 28, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. Federal civilian agencies must fix it by November 6. CISA hasn’t said who is behind the attacks or how many sites were compromised.

The flaw, rated CVSS 8.1 (High), affects versions 4.7 through 7.1.3. During a full core upgrade, files staged under wp-content/upgrade can briefly be reached from the web, letting an attacker with good timing hijack the installer and point it at their own database. No login is needed.

WordPress 7.1.4 fixes it, with backported releases for older branches down to 4.7.39; versions 4.6 and earlier get no fix. Admins should confirm the update installed, block web access to wp-content/upgrade until it does, and check logs for requests to PHP files in that folder.

Source: Cybersecurity News