Skip to content
Active Exploitation of WordPress Update Flaw CVE-2026-119977 Confirmed

Active Exploitation of WordPress Update Flaw CVE-2026-119977 Confirmed

First seen 6 Nov 2026, 18:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 6, 2026 at 18:48 UTC
  • •CVE-2026-119977 allows remote code execution during WordPress updates.
  • •CISA confirmed active exploitation of the vulnerability as of November 3, 2026.
  • •Over 240,000 exploit attempts were blocked by Wordfence following the patch release.

A vulnerability (CVE-2026-119977) in WordPress allows attackers to execute code during core updates, affecting versions 4.7 to 7.1.3. Discovered by Umut Bayram, the flaw enables remote code execution without authentication if an attacker accesses temporary update files at the right moment. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming active exploitation. WordPress released a fix (version 7.1.4) on October 28, 2026, which randomizes temporary directory names to mitigate the risk. However, the update process itself can still expose sites momentarily, leading to potential attacks. Over 240,000 exploit attempts were reported by Wordfence shortly after the patch was released. Administrators are urged to update immediately to protect their sites from ongoing threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 21h ago How this analysis works

Timeline

2026-10-28
WordPress releases security fix
WordPress version 7.1.4 released to address CVE-2026-119977, randomizing temporary directory names.
Linuxsecurity
2026-11-03
CISA adds CVE-2026-119977 to KEV catalog
CISA confirms active exploitation of the WordPress vulnerability, urging users to patch promptly.
Hackread
2026-11-06
Active exploitation confirmed
Reports indicate over 240,000 exploit attempts targeting the WordPress flaw since the fix was released.
Mezha

More articles in this cluster (12)

Following this threat?

Track CVE-2026-119977 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 4

Common questions

Which versions of WordPress are affected?
WordPress versions 4.7 through 7.1.3 are affected by CVE-2026-119977.
What is the current status of exploitation?
Active exploitation of the vulnerability has been confirmed, with significant attempts reported.
What should I do to protect my site?
Update to WordPress version 7.1.4 or the corresponding patched release for older branches immediately.