CISA has confirmed active exploitation of CVE-2026-119977 in WordPress Core and added it to the KEV catalog. The risk appears during the core upgrade itself; the fix shipped in version 7.1.4.
The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on 3 November 2026 that CVE-2026-119977, a flaw in WordPress Core, is being actively exploited, and added it to the Known Exploited Vulnerabilities (KEV) catalog. Rated 8.1 on the CVSS scale, the issue allows remote code execution on the server during the brief window in which WordPress updates its own core files.
Where the flaw actually sits
The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition. During a full-package core upgrade, WordPress unpacks files into temporary directories under wp-content/upgrade that are web-accessible and predictably named. An attacker who hits the right path inside that window can run code on the server using installer files not yet moved into place.
The flaw was reported by Picus Security researcher Umut Bayram. The WordPress security team shipped the fix in version 7.1.4 on 28 October 2026 and advised site owners to update "immediately." The patch was also backported to older release branches, so sites that are not on 7.x still have a fixed release available on their own branch.
Why it matters
The attack window is narrow; the volume is not. Wordfence reported blocking 13,095 attacks targeting this vulnerability in 24 hours. Under Binding Operational Directive 26-04, CISA gave US federal civilian agencies until 6 November 2026 to remediate, and urged all network defenders, private sector included, to prioritise the patch.
The logic here runs against the usual instinct. The risky moment is not the time you spend postponing the update; it is the update itself. "Auto-updates are on, so we're fine" does not settle the question on its own, because every full core upgrade performed before reaching a fixed release opens a window.
What this means for SMEs
Most small and mid-sized companies run their corporate site, dealer portal and careers page on WordPress. Many were built by an agency years ago, handed over, and never placed under anyone's ongoing responsibility since. They often share a hosting account with corporate mail, form submissions and sometimes customer records.
A site described as "just marketing" still processes personal data through its contact form, quote request form or CV upload field. An attacker with code execution on the server can reach those records, which makes the incident a data security breach under Article 12 of Turkey's Personal Data Protection Law (KVKK) and can trigger a notification obligation to the Board. Treating the website as marketing's problem does not remove that obligation.
What we recommend at Kamer Bilişim
- Verify the version today instead of assuming it. Check the core version under Tools > Site Health. On the 7.1 branch you need 7.1.4 or later; on an older branch, move to that branch's patched release. Sites managed through Composer or a deployment pipeline follow their own schedule, and auto-updates may be switched off entirely.
- Block web access to the upgrade directory until you patch. Deny requests beginning with /wp-content/upgrade/ in your server configuration and confirm from a browser that the path returns 403. If a WAF or CDN sits in front of the site, add the same rule there.
- Hunt for signs of exploitation after updating. Review web server logs for requests to wp-content/upgrade, look for unexpected PHP files, and check for administrator accounts you do not recognise. Once patched, take a full backup and keep it in a separate, secured location.
If you are not certain which WordPress version your site runs, which access rules your hosting enforces, or whether your most recent backup can actually be restored, we can run that check for you. We cover version verification, server hardening and backup testing together, on site across the Anatolian side of Istanbul or remotely. Get in touch via our contact page.
Source: BleepingComputer, "CISA flags WordPress RCE flaw as actively exploited in attacks" (3 November 2026); The Hacker News, "CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades"; CISA Known Exploited Vulnerabilities Catalog.
Source: BleepingComputer