CISA Says WordPress Core Flaw Is Being Exploited

US cyber authorities have added a WordPress Core vulnerability to their list of flaws known to be exploited in real attacks. The change turns an already urgent security update into a more immediate task for website operators, particularly those managing older WordPress installations or a large fleet of sites.

The vulnerability, CVE-2026-119977, concerns a weakness in the software upgrade process that can allow remote code execution during the upgrade window. WordPress addressed the issue in version 7.1.4, released on 28 October, and recommended that sites update immediately. The fresh development is the exploitation finding: the US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalogue on 3 November, according to a Canadian Centre for Cyber Security advisory.

This is a WordPress Core issue, not a flaw in a particular plugin or theme. The exposure arises during the process of installing an update, which is why it should not be described as allowing attackers to take over every unpatched site at any moment. The exact conditions matter, but the possibility of code execution during a routine maintenance operation makes the patch important even for sites with otherwise careful security practices.

CISA’s listing signals that exploitation has been observed. It does not, by itself, establish how many sites have been compromised, which attackers are responsible or whether the activity is part of a broad campaign. Those limits are worth keeping in view as administrators decide what to check. The agency’s 6 November deadline applies to US federal civilian agencies under its binding remediation process; it is not a universal legal deadline for every WordPress owner.

Administrators should check the installed WordPress version and apply 7.1.4, or the relevant security backport if they are on an eligible older branch. WordPress says fixes were being backported to branches eligible for security updates as far back as 4.7, but only the latest branch is actively supported. Managed hosts should confirm that the fix has actually reached each site rather than assume an automatic update completed successfully.

Operators should also review update logs and unexpected file or administrator-account changes where an installation may have been exposed. Routine backups remain important before maintenance, but a backup is not a substitute for applying the fix. The advice is separate from the critical PHP vulnerabilities TechBooky reported in October; WordPress and PHP are different layers of a web stack and require their own updates.

For organisations running many sites, the immediate challenge is inventory. A central dashboard or host account may show some installations while leaving forgotten microsites behind. The KEV addition makes it especially important to find those sites, verify their versions and record when the remediation was completed.