CISA adds WordPress flaw to active exploits list

On Tuesday (3), the U.S. cybersecurity agency CISA included CVE-2026-119977, a flaw in the core of WordPress, in its catalog of known exploited vulnerabilities (KEV), according to the alert published by the agency. This inclusion signifies that CISA has evidence of active exploitation. U.S. civilian federal agencies have until November 6 to address this issue, according to the catalog entry, a three-day deadline consistent with directive BOD 26-04.

The vulnerability affects all versions of WordPress from 4.7.0 to 7.1.3. The fix was released on October 28, with version 7.1.4 and backdated updates for each branch since 4.7. This means that anyone who has not applied the update from six days ago is running software listed by the U.S. government as a target for ongoing attacks.

A window of seconds, open during updates

The flaw is of the TOCTOU (time-of-check, time-of-use) type, a race condition. During a complete core update, WordPress creates temporary directories in predictable and web-accessible paths, within wp-content/upgrade. An unauthenticated attacker who hits this path at the right moment can execute code on the server, according to analyses published by Wordfence and independent researchers.

The operational detail that makes this case relevant for corporate security teams is detection. Since the malicious request directly accesses the temporary PHP file without loading WordPress, an application firewall running as a plugin within WordPress itself may not see the attack. Published recommendations point to server web access logs, rather than CMS dashboards.

High or low? Divergence on severity

Wordfence, which acted as the numbering authority (CNA) and assigned the CVE, rates the flaw with a CVSS 3.1 score of 8.1, indicating high severity. The WordPress project itself, in the security notice for version 7.1.4, classified the issue as low severity.

Both sides have arguments. WordPress's position relies on the fact that exploitation depends on timing: it only works on servers in the middle of an update, and the window is short. Wordfence's position is based on scale: the defect is in the core, not in a plugin, and every installation goes through the vulnerable window each time it gets updated. The company reported blocking tens of thousands of exploitation attempts in the first 24 hours after publishing the corresponding firewall rule on October 28.

Inclusion in the KEV resolves the practical discussion but does not address the technical one. Blocked attempts are not confirmed intrusions, and neither WordPress nor Wordfence published indicators of compromise, such as IP addresses or hashes, by the time this article was finalized. CISA also did not detail which organizations were attacked.

What to do, and where the risk lands

The consolidated guidance is to update to version 7.1.4 or to the patched version of the branch in use. Until that is possible, blocking HTTP access to the wp-content/upgrade directory reduces the attack surface. Additional caution noted by researchers: updating from a very old version may briefly recreate the temporary directory, so the block should come before the update, not afterward.

In the United States, the immediate effect is regulatory for the federal public sector, which has a deadline until Friday, and indirect for government suppliers, who often inherit KEV deadlines in contracts. In the European Union, an intrusion through this route in a site collecting personal data falls under the GDPR notification regime, with a 72-hour deadline to inform the data protection authority. In Brazil, the same intrusion triggers the ANPD's incident communication regulation, which requires notice within three business days when there is a relevant risk to data subjects.

The common channel for these three markets is the same: WordPress is rarely in the CISO's inventory. It resides in marketing, at outsourced agencies, on campaign microsites, and in HR portals, hosted outside of the core infrastructure. For consultancies managing vulnerabilities for clients, this week’s useful question is not whether the client uses WordPress, but who updates each installation and if anyone is reviewing the web server logs during the update window.