CISA adds Exploited WordPress race condition to KEV catalog

CISA placed CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition, into its Known Exploited Vulnerabilities catalog on Nov 3, 2026 after finding evidence of active exploitation.

CISA accepts vulnerability nominations through its KEV Nomination Form, and each proposed addition must include a CVE ID, proof of active exploitation, and documented mitigation steps. The agency keeps the evidence behind any Known Exploited Vulnerabilities catalog listing unpublished.

The Industry KEV feed carried the listing on Oct 30, 2026, and CIRCL KEV added the entry on Nov 3, 2026. Inclusion in the catalog indicates CISA has observed real-world exploitation, though not every site using the older upgrader was necessarily hit. CISA describes this vulnerability class as a common attack vector for malicious cyber actors and says it creates major risks for federal systems.

Versions 4.7.0 through 7.1.3 of WordPress Core are affected by CVE-2026-119977, which scores 8.1 on the CVSS v3.1 scale and is rated high severity. The flaw was publicly disclosed on October 31, 2026.

Wordfence, serving as the CVE Numbering Authority, released CVE-2026-119977 on Oct 31 with a CVSS 3.1 score of 8.1. The National Vulnerability Database lists the CVE-2026-119977 record as Deferred and has assigned no score. The WordPress advisory GHSA-4w3m-c66w-69mg gives the vulnerability a Low rating, whereas Wordfence rates it High. EPSS puts the probability of exploitation within the next 30 days at 0.6 percent, and its CVSS vector string reads CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

CWE-367, a time-of-check time-of-use race condition, and CWE-552, covering files or directories accessible to external parties, classify the flaw. In this condition, a program checks a resource and then uses it, leaving a window an attacker can exploit. The flaw lets unauthenticated attackers run remote code on the web server while a full-package core upgrade is underway.

During full-package upgrades, predictable staging directories become reachable over the web, allowing attackers to drop malicious payloads and trigger execution without authentication. An exploited site must be halfway through a full core upgrade while its upgrade folder is reachable over the web for a few seconds.

Binding Operational Directive 26-04 obliges Federal Civilian Executive Branch agencies to remediate KEV-listed high-risk flaws on internet-facing assets that grant attackers full control after compromise. The directive also establishes timing rules for agencies to determine whether intruders entered before the patch was applied. It binds only Federal Civilian Executive Branch agencies, although CISA encourages every organization to manage vulnerability risk according to its priorities. The remediation deadline for federal civilian agencies is Nov 6, 2026 for CVE-2026-119977.

Wordfence observed more than 18,500 attempts to contact staged installer paths in the first 21 hours after its firewall rule went live. No public report describes a specific WordPress site compromised through CVE-2026-119977. Applying the patch closes the hole for future updates without showing whether an earlier update was already raced.

WordPress has issued fixed release 7.1.4 plus backports 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11 and 4.7.39 spanning every branch from 4.7 upward. Versions older than 4.7 fall outside the affected range, which begins at 4.7.0. Sites built with Composer, git or container images and running with DISALLOW_FILE_MODS enabled never invoke the built-in update tool, eliminating the upgrade race.