# WordPress CVE-2026-119977 Is Under Attack: Update to 7.1.4 Now

- URL: https://usa-24.com/wordpress-cve-2026-119977-under-attack/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-07T14:37:38.612Z
- Updated: 2026-11-07T14:37:38.620Z
- Topics: WordPress, Web Security, Patch Management, CISA, Cybersecurity

> Attackers are exploiting a WordPress core flaw during site upgrades, and the federal patch deadline passed Friday. Sites running 4.7.0 through 7.1.3 should update to 7.1.4 now.

## Key takeaways

- CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, and the federal civilian patch deadline was November 6.
- The flaw affects WordPress Core 4.7.0 through 7.1.3 and is fixed in version 7.1.4, which WordPress released on October 28, 2026.
- The bug is timing-dependent, so exposure is limited to servers that are actively running a core upgrade, according to Trend Micro.
- WordPress 2.7 through 4.6 received no fix and need a full upgrade to a supported release.
- Sites that cannot update right away can block public access to wp-content/upgrade and confirm the folder cannot be listed.

## What CVE-2026-119977 lets attackers do

Attackers are exploiting a WordPress core flaw, CVE-2026-119977, while sites are in the middle of an upgrade, and the federal deadline to patch it passed on Friday. CISA added the bug to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog) on November 3, 2026, “based on evidence of active exploitation,” and set November 6 as the patch deadline for federal civilian agencies.

The flaw lets an unauthenticated visitor execute code on a server during the upgrade window. [The Hacker News reported on November 4](https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html) that exploitation events were observed on October 30, four days before CISA's listing. The CVSS 3.1 base score is 8.1, rated High. Researcher Umut Bayram reported the bug.

Wordfence published technical details on October 31, and [Trend Micro's alert](https://success.trendmicro.com/en-US/solution/KA-0024925) lists the same date. WordPress had already shipped the fix on October 28, in version 7.1.4. That left a gap of about a week between the patch and the federal listing, and attackers used it.

## Which WordPress versions are affected and which are fixed

The vulnerable range covers WordPress Core 4.7.0 through 7.1.3, according to Trend Micro and CISA's catalog entry. [Pasquale Pillitteri's analysis](https://pasqualepillitteri.it/en/news/30076/cisa-confirms-wordpress-cve-2026-119977) notes that the 7.1.4 release closed 22 flaws in total, and that this bug is the only one among them that leads to code execution without an account.

| WordPress version | Status | What to do |
|---|---|---|
| 2.7 through 4.6 | No fix released | Full upgrade to a supported release |
| 4.7.0 through 7.1.3 | Affected | Update to 7.1.4 or later |
| 7.1.4 and later | Fixed | Keep the site current |

The fix was backported to every maintained branch down to 4.7, according to [Picus Security](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability). Sites on WordPress 2.7 through 4.6 got no patch at all, so for those sites the fix is a full upgrade to a supported release.

## How the upgrade race turns into code execution

The bug sits in the full-package core updater, the code path that downloads a complete WordPress release and installs it. Affected versions unpack new files into wp-content/upgrade, a folder with a predictable name that the web server can reach. An attacker who guesses that path can race the update, place a PHP file there and run it.

Picus Security also researched a related path that can overwrite the live wp-config.php file, which stores database credentials. That finding shows why defenders should treat the upgrade folder as attack surface rather than temporary scratch space.

Trend Micro says the exposure is timing-dependent and limited to servers actively performing an upgrade. That narrows the risk on any given night. It does not make an unpatched site safe, because the vulnerable code keeps running until the site is updated, and every routine upgrade opens the same window.

This is the second WordPress core flaw CISA has listed in 2026. A separate REST API chain, tracked as wp2shell under CVE-2026-63030 and CVE-2026-60137, was patched in July, according to [Tech-Insider](https://tech-insider.org/wordpress-cve-2026-119977-cisa-kev-7-1-4-deadline-nov-6-2026/). Two core problems in one year put attention on the update mechanism itself, the thing site owners depend on to stay safe.

## How to tell if a WordPress site was hacked

No public count of compromised WordPress sites exists in the sources I reviewed. Some blogs have circulated figures for how many sites run affected versions and how many exploit attempts were logged. I could not confirm those numbers from a government or WordPress source, so this story leaves them out.

You can check your own site, and the upgrade folder is the place to start. [SOC Prime](https://socprime.com/blog/cve-2026-119977-wordpress-core-rce-flaw-exploited-during-software-upgrades/) and [The Hacker News](https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html) describe leftover setup-config.php files in the upgrade directory as a sign of an attempted attack. Finding one does not prove a breach, but it justifies a closer look.

- Look for a setup-config.php file or other unfamiliar PHP files in wp-content/upgrade.
- Review the admin user list for accounts you did not create.
- Compare core, plugin and theme files against clean copies, or run a file integrity scanner.
- Give extra attention to any site that stayed on an affected version after October 28.

## Steps to update to 7.1.4 and block the upgrade folder

Researchers recommend updating to 7.1.4 or later. Blocking the upgrade folder is a stopgap, not a substitute for the update.

1. Check your version. In the WordPress admin, open Dashboard, then Updates. From the command line, run wp core version with WP-CLI.
2. Back up your files and database, then update to 7.1.4 or later.
3. If you cannot update right away, block public web access to wp-content/upgrade at the web server. Then load that folder's URL in a browser and confirm it does not list its contents.
4. After updating, recheck the upgrade folder and the admin accounts.
5. If you run WordPress 2.7 through 4.6, plan a full upgrade to a supported release. A security patch will not cover those versions.

I found no reporting in the sources I reviewed of compatibility problems with 7.1.4. Still, test on a staging copy first if your site runs custom code. If a managed host runs your site, ask whether it applied the update for you. The sources I reviewed do not say whether any host did.

## Why the federal deadline matters to private companies

BOD 26-04 requires federal agencies to prioritize rapid patching of KEV entries on exposed assets. Private businesses are not bound by it, but CISA encourages them to follow it, and the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) gives private security teams a ready-made priority list.

The bigger risk lies in concentration. Hosting providers and managed WordPress shops run many sites on shared configurations, so one unpatched server can expose many customers at once. Small businesses and bloggers rarely track CVE notices, which makes them the likeliest to miss a window that opened while they were not watching.

## What is still unknown and what to watch

Three questions remain open. No threat group has been publicly tied to this campaign in the reporting I reviewed. The total number of compromised sites is not confirmed. And it is unclear whether managed hosts pushed emergency updates for their customers.

Watch the KEV entry for changes as evidence accumulates, and watch WordPress for a fuller account of the upgrade-path fix. Attackers are working other targets too. Our [PHP2Shell report](https://usa-24.com/php2shell-exploits-palo-alto-firewalls/) covers exploitation that reaches Palo Alto firewall interfaces, and our [SonicWall CVE-2026-19868 story](https://usa-24.com/sonicwall-cve-2026-19868-sslvpn-exploit/) explains a similar patch-now warning for SSLVPN appliances.

The next useful signal will come from CISA's catalog and from hosting providers, which are best placed to report how many customers were touched. Until then, treat every site on 4.7.0 through 7.1.3 as in scope, and give any site that sat on an affected version since October 28 a file check.

## Frequently asked questions

### Is CVE-2026-119977 being actively exploited?

Yes. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, based on evidence of active exploitation. The Hacker News reported that exploitation events were observed on October 30, 2026. No government or WordPress tally of compromised sites has been published.

### Which WordPress version fixes CVE-2026-119977?

WordPress 7.1.4, released October 28, 2026, fixes the flaw. The fix was backported to every maintained branch down to 4.7. WordPress 2.7 through 4.6 received no fix and need a full upgrade to a supported version.

### How do I know if my WordPress site was hacked?

Check the wp-content/upgrade folder for leftover setup-config.php files or other unfamiliar PHP files, which researchers describe as a sign of an attempted attack. Then review admin accounts and compare core, plugin and theme files with clean copies. A finding is a reason to investigate, not proof of a breach.

### Can I block the upgrade folder instead of updating WordPress?

Blocking public access to wp-content/upgrade is a stopgap, not a fix. Confirm the folder cannot be listed after you block it. Researchers recommend updating to 7.1.4 or later as soon as possible.

### Does the federal deadline apply to private businesses?

Not directly. BOD 26-04 requires federal agencies to prioritize rapid patching of KEV entries on exposed assets. Private businesses are not bound by it but are encouraged to follow it.

## Sources

1. [CISA Adds One Known Exploited Vulnerability to Catalog, November 3, 2026](https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog)
2. [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
3. [CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades](https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html)
4. [SECURITY ALERT: WordPress Core unauthenticated RCE (CVE-2026-119977)](https://success.trendmicro.com/en-US/solution/KA-0024925)
5. [CVE-2026-119977: When Updating WordPress Becomes the Vulnerability](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability)
6. [CISA confirms attacks on WordPress flaw CVE-2026-119977](https://pasqualepillitteri.it/en/news/30076/cisa-confirms-wordpress-cve-2026-119977)
7. [CVE-2026-119977: WordPress Core RCE Flaw Exploited During Software Upgrades](https://socprime.com/blog/cve-2026-119977-wordpress-core-rce-flaw-exploited-during-software-upgrades/)
8. [WordPress CVE-2026-119977: CISA Sets Nov. 6 Deadline [2026]](https://tech-insider.org/wordpress-cve-2026-119977-cisa-kev-7-1-4-deadline-nov-6-2026/)