CISA Flags an Exploited WordPress Core Upgrade Flaw
The US Cybersecurity and Infrastructure Security Agency added a WordPress core upgrade flaw to its Known Exploited Vulnerabilities catalogue on 3 November. An unauthenticated attacker can gain code execution while a vulnerable site runs a full core upgrade. WordPress released 7.1.4 and fixes for older branches on 28 October. The CISA listing sets a 6 November deadline for covered US federal agencies and calls for forensic triage. CVE-2026-119977 · CISA catalogue · WordPress release
The upgrade itself opens the window
During a full-package upgrade, affected WordPress versions unpack files in a predictable staging location under wp-content/upgrade/. If the web server serves that directory and can run the staged installer, a remote request can reach code intended to run only in the normal upgrade process. The timing depends on the upgrade window and the server’s configuration. Routine traffic to a site does not establish that the staged installer was reachable. WordPress security advisory · Wordfence technical record
Check the installed branch and the last upgrade
Verify the core version on each installation, including staging sites. WordPress lists 7.1.4, 7.0.8 and 6.9.11 among the fixed releases. Check the advisory for the exact fix on older branches. If a vulnerable site still needs a full upgrade, arrange a maintenance window, restrict public HTTP access to the upgrade directory first and confirm that the restriction works at the origin as well as through any proxy. Confirm the new core version after the upgrade finishes. WordPress fixed versions
Update, 5 November 2026
California’s Cybersecurity Integration Center recommended checking web logs for requests to the staging directory during upgrade windows, verifying core file checksums and reviewing unexpected PHP files, plugins and administrator accounts. Match suspicious requests to upgrade times and preserve the relevant logs before cleanup. Wordfence’s blocked requests measure attempts. The logs and state of an individual installation determine whether it needs further incident response. California advisory · Wordfence technical record
