WordPress core CVE-2026-119977 (CVSS 8.1, on CISA KEV). Versions 4.7 to 7.1.3 are affected, 7.1.4 fixes it. What it is and what to do.
When a WordPress site updates its core, there is a short window where the system checks some files and then uses them. In that window, an unauthenticated attacker can get code to run on the server. The flaw was published only a few days ago, but CISA has already added it to its list of actively exploited vulnerabilities.
Short answer: CVE-2026-119977 in WordPress core lets an unauthenticated attacker run code on the server during a full-package core upgrade, by abusing predictable staging paths. The NVD record lists versions 4.7 through 7.1.3 as affected, and WordPress fixed it in 7.1.4. CISA added it to KEV on November 3, 2026, with a remediation due date of November 6, 2026. Check your site’s version today and move to 7.1.4 or later.
What happened?
WordPress core is updated either with small patches or with a full package. This flaw affects full-package upgrades. During those upgrades, WordPress writes temporary files to specific, predictable paths, and those paths are reachable over the web.
The problem is the gap between checking something and using it. The weakness is classified as CWE-367, a time-of-check to time-of-use (TOCTOU) race condition. If the file can be changed in that short gap, the system may end up using something it never meant to run.
This is a new flaw, but CISA’s record already says it is known to be exploited. The record says the use in ransomware campaigns is unknown. It also refers to CISA’s forensic triage requirements, so if you suspect you were hit, keep the logs and plan a review after you update.
Who is affected?
| Item | Detail |
|---|---|
| CVE ID | CVE-2026-119977 |
| Product | WordPress Core |
| CVSS | 8.1 (v3.1) |
| Severity | High |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Weakness type | CWE-367 (TOCTOU race condition) |
| Affected versions | 4.7 through 7.1.3 (NVD) |
| Fixed version | 7.1.4 (WordPress announcement) |
| NVD published | October 31, 2026 |
| Added to CISA KEV | November 3, 2026 |
| CISA due date | November 6, 2026 |
The WordPress announcement says the security fixes were backported to every branch that still receives security fixes. It does not list which older branch gets which patch version, so if you run an older branch, check the release page for your line. The announcement also does not mention the CVE ID. I matched it using the NVD and CISA records.
What should you do?
- Find your version. If WP-CLI is installed, run
wp core versionin the site root. Otherwise, check the$wp_versionline inwp-includes/version.php, or go to Dashboard > Updates in the admin panel. - Compare it with the range. Versions 4.7 through 7.1.3 are affected. If you run 7.1.4 or later, this flaw does not apply to you.
- Back up first. Save your files and your database before you update. If something goes wrong, the backup is how you get back.
- Update. Click “Update now” in the admin panel, or run
wp core update. If automatic background updates are enabled, the WordPress announcement says the update starts on its own. Still check the result. - Verify.
wp core versionshould now return 7.1.4 or higher. The admin panel should show the same version. - If something looks wrong, isolate and preserve. If you see unknown files, admin accounts you do not recognise, or unexpected wp-admin requests before or after the update, take the site offline for a while. Keep the logs instead of deleting them, and call your server admin or security contact right away.
The source does not list a workaround. The only advice given is to update. If you cannot update, CISA’s guidance for the record says to discontinue use of the product when mitigations are not available. You need to decide what that means for your site.
Frequently asked questions
Does this affect me?
Yes, if your version is between 4.7 and 7.1.3, according to the NVD record. You can find your version in seconds with the commands above. If you are on 7.1.4 or later, you are not affected by this flaw.
The CVSS score is 8.1. Is it really this urgent?
Yes. The score is high, and more importantly, CISA lists the flaw as known to be exploited. Vulnerabilities on that list have been seen in real attacks. A CVSS score alone does not tell you how much risk you face.
What if I cannot update right away?
There is no workaround in the source. Schedule the update as soon as possible, take a backup first, and in the meantime review admin accounts and unexpected files. If you cannot update at all, the decision about whether to keep the site running is yours, and it depends on how important the site is.
Sources
- NVD record: CVE-2026-119977
- CISA Known Exploited Vulnerabilities Catalog
- WordPress 7.1.4 security release announcement
This article was prepared on November 6, 2026 based on the CISA and NVD records. It will be updated if new information appears. For WordPress updates or server maintenance, you can reach me through the quote form.