The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977, a high-severity WordPress Core race condition, to its Known Exploited Vulnerabilities catalog on November 3, citing evidence of active exploitation.
The flaw could allow unauthenticated attackers to execute code on a server during a full-package core upgrade, when predictable staging paths are temporarily accessible over the web. It carries a CVSS score of 8.1.
WordPress disclosed the underlying upgrade-process weakness in its October 28 security release. The issue affects WordPress versions 4.7 through 7.1.3 and is fixed in 7.1.4, with security backports for older supported branches reaching 4.7.39. Abijita previously reported the release’s 22 security fixes and nearly 63,000 blocked exploit attempts against the upgrade-window flaw.
CISA set November 6 as the remediation deadline for U.S. federal civilian agencies under Binding Operational Directive 26-04. The catalog entry confirms exploitation but does not identify affected WordPress sites or disclose the number of successful compromises.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
