If your site runs WordPress on a version lower than 7.1.4, a stranger can execute their own code on it without a password, right at the moment the site runs a core update. According to the National Vulnerability Database (NVD), CVE-2026-119977 is present in every WordPress version from 4.7.0 through 7.1.3. The fix shipped on October 28, 2026 in version 7.1.4.
CISA added the flaw to its Known Exploited Vulnerabilities catalog (KEV) on November 3, 2026; NVD scores it CVSS 8.1, and US federal agencies must fix it by November 6, 2026. It was discovered by Umut Bayram of Picus Security, who reported it directly to the WordPress security team.
- CVE-2026-119977 affects WordPress 4.7.0 through 7.1.3; the fix is in version 7.1.4 from October 28, 2026.
- CISA confirmed active exploitation and added the flaw to the KEV catalog on November 3, 2026.
- The CVSS score is 8.1 out of 10, but the attack is hard to pull off (exploitability only 2.2 out of 10).
- You can check your WordPress version in five minutes via readme.html or the wp core version command.
- WordPress.org lists no other defense besides updating to 7.1.4.
As of November 5, 2026, W3Techs counted WordPress as powering 39.5% of all websites worldwide and 58.2% of websites whose content management system is known. The pool of potentially affected installations is therefore enormous.
What broke in the update process
The flaw is a time-of-check, time-of-use bug (CWE-367): during a full core update, WordPress temporarily stores new files at a predictable path that anyone on the internet can see. Whoever guesses that path at the right moment can upload to it and execute their own code without ever logging in. The attacker only has a short window while the update is running. NVD accordingly says the attack is hard to pull off, recording it in the CVSS vector as AC:H and giving it an exploitability score of just 2.2 out of 10. Its impact score, though, is 5.9 out of 10: whoever lands it reaches the data on the server, can read it, change it, and take the site down (C:H/I:H/A:H).
The same patch in 7.1.4 changes two files in core: the upgrader class and the page where WordPress checks for updates. The flaw therefore sits in the very mechanism WordPress uses to update itself, not in some plugin or theme.
Who is affected
This affects you if your site runs WordPress 7.1.3 or older, including every older branch: 4.7, 4.8, 4.9, 5.0 through 5.9, 6.0 through 6.9, and 7.0. NVD does not list a separate patched version for any of these branches. The only safe path is to move to 7.1.4.
Ask your administrator if an agency or a host runs the site and you don't personally know the WordPress version, or if you don't know whether automatic core updates are turned on.
This does not affect you if the site doesn't run WordPress at all (a different system, a static page, a custom application), or if the WordPress version is already 7.1.4 or newer.
How to check your version in five minutes
In the site's admin area (wp-admin) you'll find the version number on the Tools or Updates page. A faster way: you don't even need to log in, just open yourwebsite.com/readme.html in a browser and WordPress displays the version there publicly. If you can reach the server over the command line and have WP-CLI, the command wp core version will tell you the version.
An attacker can read that same readme.html page just as easily, and finds vulnerable installations as readily as you're checking your own. This has no direct connection to CVE-2026-119977; that file sits in every default WordPress install, regardless of version, and long predates this bug.
- October 28, 2026Fix releasedWordPress released version 7.1.4 with the fix.
- November 3, 2026Added to KEVCISA confirmed active exploitation and added the flaw to the KEV catalog.
- November 6, 2026Federal deadlineUS federal agencies must have the fix deployed.
Is this already being exploited?
On November 3, 2026, CISA wrote that attackers are already actively exploiting the flaw, but has not yet attributed any specific ransomware campaign to it: the "known ransomware campaign use" field is set to Unknown. Who is running the attacks and how many sites they've already hit, CISA had not disclosed as of November 5, 2026.
For US federal agencies, CISA also sets the "forensicTriage" field to Yes for this flaw and points them to its separate forensic-investigation guidance, not just the patch. For cloud services, it additionally points them to Binding Operational Directive BOD 26-04 (Prioritizing Security Updates Based on Risk); if no fix is available, the agency must stop using the product.
What to do if you can't update right now
Version 7.1.4 also fixes at least eight other bugs: several stored XSS vulnerabilities and a hole that let unprivileged users read unpublished theme-appearance drafts in the Customizer; it also refreshes the bundled root-certificate set, because WordPress revoked the eMudhra certificate. The longer you wait, the longer these other bugs stay open too, not just this one.
If you can't update it yourself right away, tell your hosting administrator or agency as the next step; don't wait for a regular maintenance slot. WordPress's announcement for version 7.1.4 does not list any other way to defend against this without updating.
Common questions
Is it enough that I have automatic core updates turned on?
In most cases, yes, provided the site runs a version for which WordPress allows automatic updates. After the update, though, check the version anyway on the readme.html page or in the admin area: not every installation has automatic core updates switched on.
I'm running an old WordPress version, say from the 5.x branch. Is updating to the latest release of that branch enough?
No. NVD lists no separately patched version for branches 4.7 through 7.0. The only patched version remains 7.1.4. If you move from an old branch, you may first need to check that your theme and plugins work with the new version.
How long does the vulnerable window last while the core updates?
NVD doesn't give an exact length in seconds. It only says the attack is hard to pull off, recording it in the CVSS vector as AC:H: the attacker has to hit a short time window and a predictable path at the same time.
Does this also affect sites on Czech hosting, or is it a US-only problem?
The flaw is in WordPress core itself, not in any particular host. It affects every installation regardless of country. The November 6, 2026 deadline applies only to US federal agencies; for everyone else it's just the date from which CISA counts the flaw as actively exploited, not a hard deadline that binds you to anything.
What if an outside agency runs the site?
Ask them directly what WordPress version the site runs and when they last updated core. You don't have to wait for their answer: the publicly available readme.html page will tell you the version right away.
- NVD, CVE-2026-119977: nvd.nist.gov/vuln/detail/CVE-2026-119977
- CISA, Known Exploited Vulnerabilities Catalog: cisa.gov/known-exploited-vulnerabilities-catalog
- WordPress.org, "WordPress 7.1.4": wordpress.org/news/2026/10/wordpress-7-1-4
PHP2Shell vulnerability: does it affect your website and what to do
PCI DSS: what it is, who it applies to and when a firm needs a penetration test
Ransomware: how to defend and what to do when it strikes
