Skip to content
CISA Alerts on Exploitation of WordPress Update Vulnerability

CISA Alerts on Exploitation of WordPress Update Vulnerability

First seen 6 Nov 2026, 12:14 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 12:15 UTC
  • •CISA confirmed active exploitation of CVE-2026-119977 in WordPress.
  • •The vulnerability allows remote code execution during core updates.
  • •WordPress released a patch on October 28, 2026, urging immediate updates.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the exploitation of a WordPress vulnerability, tracked as CVE-2026-119977, which allows attackers to hijack websites during core updates. This flaw, affecting versions from 4.7 to 7.1.3 and traced back to WordPress 2.7, enables remote code execution without authentication if an attacker accesses temporary update files at the right moment. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on November 3, 2026, following its discovery by security researcher Umut Bayram. WordPress released a patch on October 28, 2026, to address the issue by randomizing temporary directory names and preventing unauthorized file copying. The urgency of the situation is underscored by CISA's directive for federal agencies to update by November 6, 2026. Users are advised to check their site versions and apply the necessary updates promptly to mitigate potential risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 4h ago How this analysis works

Timeline

2026-10-28
WordPress patch released
Version 7.1.4 was released to fix the vulnerability by randomizing temporary directory names.
Hackread
2026-11-03
CISA adds CVE-2026-119977 to KEV catalog
CISA confirmed active exploitation of the WordPress vulnerability and added it to its Known Exploited Vulnerabilities catalog.
Linuxsecurity
2026-11-06
CISA deadline for federal agencies
CISA set a deadline for US federal agencies to apply the patch for the WordPress vulnerability.
Hackread

More articles in this cluster (2)

Following this threat?

Track CVE-2026-119977 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

Which versions of WordPress are affected?
The vulnerability affects WordPress versions from 4.7 to 7.1.3, with older versions also potentially impacted.
What is the nature of the exploitation?
Attackers can execute remote code during core updates by accessing temporary files if they are reachable over the web.
What should WordPress site owners do?
Site owners should immediately update to WordPress version 7.1.4 or later to mitigate the vulnerability.