The US Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress flaw to its Known Exploited Vulnerabilities (KEV) catalogue. The addition of CVE-2026-119977 was made on 3 November 2026, and federal civilian agencies must remediate by 6 November 2026 under binding operational directives cited by the reporting outlets. This site reported the WordPress 7.1.4 security update itself on 31 October; the KEV listing is the new development.

The flaw

CVE-2026-119977, rated CVSS 8.1, is a high-severity remote code execution vulnerability in WordPress versions 4.7 through 7.1.3. It stems from predictable, web-accessible staging directories used during core updates. Unauthenticated attackers could exploit a race condition during an update to execute code. It was fixed in WordPress 7.1.4, patched on 28 October 2026 and backported to legacy branches back to 4.7.

Exploitation evidence

CISA added the flaw on evidence of active exploitation. Wordfence recorded more than 18,500 requests targeting vulnerable staging installer paths within the first 21 hours. Those are exploitation attempts, not confirmed successful compromises, and the distinction matters: the reports do not claim that many sites were breached.

Sources: SecurityAffairs, US CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog, 4 November 2026; F5 Labs, weekly threat bulletin, 4 November 2026.