Science & Tech · Cybersecurity · 2 hrs ago
CISA flags actively exploited WordPress flaw and orders federal fixes
The U.S. Cybersecurity and Infrastructure Security Agency added a WordPress flaw to its exploited-vulnerabilities list after evidence of active attacks.
The flaw, CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3 and can let attackers run code on a server.
It requires no site account, but attackers must exploit a brief window while WordPress is being updated.
More than 18,500 requests targeted vulnerable update paths in the first 21 hours, according to Wordfence; these were attempts, not confirmed successful breaches.
WordPress fixed the flaw in version 7.1.4, and patches were released late last month.
Federal civilian agencies must apply the fix by November 6, 2026 under a U.S. government directive.
Private organizations are also advised to check their systems and address the flaw.
CISA added the WordPress flaw CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
The high-severity flaw can let unauthenticated attackers execute code on a server during a WordPress core update.
It affects WordPress versions 4.7 through 7.1.3 and was fixed in version 7.1.4.
Wordfence recorded more than 18,500 requests targeting vulnerable installer paths in the first 21 hours after public disclosure.
Federal civilian agencies have until November 6, 2026, to apply the fixes.
- Who
- CISA added the vulnerability to its catalog. Attackers are attempting to exploit it.
- What
- A WordPress core flaw can allow unauthenticated code execution during an upgrade.
- When
- CISA listed it on November 4, 2026. Federal civilian agencies must address it by November 6, 2026.
- Where
- WordPress websites and affected servers.
- Why
- CISA cited evidence of active exploitation and the risk the flaw poses to networks.
This story does not have two clearly opposing sides.
Patches for the flaw were released.
Previdian observed exploitation attempts against its honeypot sensors.
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog.
Deadline for federal civilian agencies to apply the fixes.
- Vulnerability
- CVE-2026-119977
- Severity
- High; CVSS score 8.1
- Affected versions
- WordPress 4.7 through 7.1.3
- Fixed version
- WordPress 7.1.4
- Observed requests
- More than 18,500 in the first 21 hours after public disclosure
- Federal agency deadline
- November 6, 2026
2 sources
What people are saying
This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability.