What CVE-2026-119977 lets attackers do
Attackers are exploiting a WordPress core flaw, CVE-2026-119977, while sites are in the middle of an upgrade, and the federal deadline to patch it passed on Friday. CISA added the bug to its Known Exploited Vulnerabilities catalog on November 3, 2026, “based on evidence of active exploitation,” and set November 6 as the patch deadline for federal civilian agencies.
The flaw lets an unauthenticated visitor execute code on a server during the upgrade window. The Hacker News reported on November 4 that exploitation events were observed on October 30, four days before CISA's listing. The CVSS 3.1 base score is 8.1, rated High. Researcher Umut Bayram reported the bug.
Wordfence published technical details on October 31, and Trend Micro's alert lists the same date. WordPress had already shipped the fix on October 28, in version 7.1.4. That left a gap of about a week between the patch and the federal listing, and attackers used it.
Which WordPress versions are affected and which are fixed
The vulnerable range covers WordPress Core 4.7.0 through 7.1.3, according to Trend Micro and CISA's catalog entry. Pasquale Pillitteri's analysis notes that the 7.1.4 release closed 22 flaws in total, and that this bug is the only one among them that leads to code execution without an account.
| WordPress version | Status | What to do |
|---|---|---|
| 2.7 through 4.6 | No fix released | Full upgrade to a supported release |
| 4.7.0 through 7.1.3 | Affected | Update to 7.1.4 or later |
| 7.1.4 and later | Fixed | Keep the site current |
The fix was backported to every maintained branch down to 4.7, according to Picus Security. Sites on WordPress 2.7 through 4.6 got no patch at all, so for those sites the fix is a full upgrade to a supported release.
How the upgrade race turns into code execution
The bug sits in the full-package core updater, the code path that downloads a complete WordPress release and installs it. Affected versions unpack new files into wp-content/upgrade, a folder with a predictable name that the web server can reach. An attacker who guesses that path can race the update, place a PHP file there and run it.
Picus Security also researched a related path that can overwrite the live wp-config.php file, which stores database credentials. That finding shows why defenders should treat the upgrade folder as attack surface rather than temporary scratch space.
Trend Micro says the exposure is timing-dependent and limited to servers actively performing an upgrade. That narrows the risk on any given night. It does not make an unpatched site safe, because the vulnerable code keeps running until the site is updated, and every routine upgrade opens the same window.
This is the second WordPress core flaw CISA has listed in 2026. A separate REST API chain, tracked as wp2shell under CVE-2026-63030 and CVE-2026-60137, was patched in July, according to Tech-Insider. Two core problems in one year put attention on the update mechanism itself, the thing site owners depend on to stay safe.
How to tell if a WordPress site was hacked
No public count of compromised WordPress sites exists in the sources I reviewed. Some blogs have circulated figures for how many sites run affected versions and how many exploit attempts were logged. I could not confirm those numbers from a government or WordPress source, so this story leaves them out.
You can check your own site, and the upgrade folder is the place to start. SOC Prime and The Hacker News describe leftover setup-config.php files in the upgrade directory as a sign of an attempted attack. Finding one does not prove a breach, but it justifies a closer look.
- Look for a setup-config.php file or other unfamiliar PHP files in wp-content/upgrade.
- Review the admin user list for accounts you did not create.
- Compare core, plugin and theme files against clean copies, or run a file integrity scanner.
- Give extra attention to any site that stayed on an affected version after October 28.
Steps to update to 7.1.4 and block the upgrade folder
Researchers recommend updating to 7.1.4 or later. Blocking the upgrade folder is a stopgap, not a substitute for the update.
- Check your version. In the WordPress admin, open Dashboard, then Updates. From the command line, run wp core version with WP-CLI.
- Back up your files and database, then update to 7.1.4 or later.
- If you cannot update right away, block public web access to wp-content/upgrade at the web server. Then load that folder's URL in a browser and confirm it does not list its contents.
- After updating, recheck the upgrade folder and the admin accounts.
- If you run WordPress 2.7 through 4.6, plan a full upgrade to a supported release. A security patch will not cover those versions.
I found no reporting in the sources I reviewed of compatibility problems with 7.1.4. Still, test on a staging copy first if your site runs custom code. If a managed host runs your site, ask whether it applied the update for you. The sources I reviewed do not say whether any host did.
Why the federal deadline matters to private companies
BOD 26-04 requires federal agencies to prioritize rapid patching of KEV entries on exposed assets. Private businesses are not bound by it, but CISA encourages them to follow it, and the KEV catalog gives private security teams a ready-made priority list.
The bigger risk lies in concentration. Hosting providers and managed WordPress shops run many sites on shared configurations, so one unpatched server can expose many customers at once. Small businesses and bloggers rarely track CVE notices, which makes them the likeliest to miss a window that opened while they were not watching.
What is still unknown and what to watch
Three questions remain open. No threat group has been publicly tied to this campaign in the reporting I reviewed. The total number of compromised sites is not confirmed. And it is unclear whether managed hosts pushed emergency updates for their customers.
Watch the KEV entry for changes as evidence accumulates, and watch WordPress for a fuller account of the upgrade-path fix. Attackers are working other targets too. Our PHP2Shell report covers exploitation that reaches Palo Alto firewall interfaces, and our SonicWall CVE-2026-19868 story explains a similar patch-now warning for SSLVPN appliances.
The next useful signal will come from CISA's catalog and from hosting providers, which are best placed to report how many customers were touched. Until then, treat every site on 4.7.0 through 7.1.3 as in scope, and give any site that sat on an affected version since October 28 a file check.
