Skip to content
Of WordPress Vulnerability CVE-2026-119977

Of WordPress Vulnerability CVE-2026-119977

First seen 7 Nov 2026, 13:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 7, 2026 at 13:17 UTC
  • •CVE-2026-119977 allows remote code execution during WordPress updates.
  • •CISA added the vulnerability to its KEV list due to active exploitation.
  • •Over 18,500 exploitation attempts were recorded shortly after disclosure.

A vulnerability in WordPress, identified as CVE-2026-119977, allows remote code execution during updates, affecting versions 4.7 to 7.1.3. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities (KEV) list on November 3, 2026, due to. Over 18,500 exploitation attempts were recorded within the first 21 hours of the vulnerability's disclosure. The flaw arises from a race condition in the update process, where predictable staging directories can be exploited by unauthenticated attackers. Wordfence reported the first exploitation attempt just nine minutes after deploying a firewall rule. This vulnerability poses a significant risk, especially in regions like Mexico, Brazil, and Argentina, where WordPress is widely used by small and medium enterprises lacking dedicated security teams. A patch was released in version 7.1.4, but the urgency remains high for users to update promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-10-31
CVE-2026-119977 published
WordPress vulnerability CVE-2026-119977 disclosed, affecting versions 4.7 to 7.1.3.
Ciberseguridadlatam
2026-11-03
CISA adds CVE-2026-119977 to KEV
CISA confirmed active exploitation of the vulnerability, urging immediate patching.
sempreupdate.com.br
2026-11-05
Patch released for WordPress
WordPress version 7.1.4 was released to address CVE-2026-119977, urging users to update.
Ciberseguridadlatam

More articles in this cluster (2)

Following this threat?

Track CVE-2026-119977 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

Which versions of WordPress are affected?
The vulnerability affects WordPress versions from 4.7 to 7.1.3.
What should I do if I'm using an affected version?
Immediately update to WordPress version 7.1.4, which addresses the vulnerability.
Is the vulnerability actively being exploited?
Yes, there have been confirmed active exploitation attempts since its disclosure.