CISA KEV addition November 3, 2026; federal remediation due November 6, 2026; fix in WordPress 7.1.4, released October 28, 2026
CISA Confirms the WordPress Upgrade Flaw Is Being Exploited: Federal Fixes Are Due November 6
CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation, and federal civilian agencies have until Friday, November 6 to apply the fix under BOD 26-04. The flaw is a time-of-check time-of-use race condition in WordPress Core, rated 8.1, affecting versions 4.7 through 7.1.3: full-package core upgrades use predictable, web-accessible staging paths, so an unauthenticated attacker who hits the brief upgrade window can execute code on the server. The flaw was reported by Picus Security researcher Umut Bayram, and WordPress 7.1.4, released October 28, fixes it by addressing the staging path handling. The attempt volume is already large. Wordfence recorded more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours after public disclosure, and reported 12,632 blocked attempts in the most recent 24 hours; those figures count attempts, not confirmed compromises. Previdian honeypots logged three exploitation attempts on October 30 from an IP address geolocated in the United Kingdom. This edition covered the flaw and the early attack counts on November 2, before the KEV listing; the listing is the change, because it converts a fast-moving vendor warning into a confirmed exploitation finding with a federal deadline attached.
Executives
A flaw in the software that runs a large share of the public web is now confirmed exploited, with a three-day federal clock. The exposure question is inventory, not severity: how many WordPress sites does the organization run, including marketing microsites, campaign pages and forgotten subdomains that no central team patches. Ask for the count of sites still below the fixed releases and the date each one closes, and treat any site nobody owns as the first item on the list.
CIO / CISO
Close this on the KEV timeline even though the mandate binds federal agencies: the exploitation evidence is the point, not the jurisdiction. Verify every site is on 7.1.4 or the fixed release for its branch, then hunt rather than assume: review access logs around any core upgrade performed since October 28 for requests to staged installer paths, and check for new administrator accounts, unexpected plugins and webshell files. Automatic updates reduce the window; confirm they are enabled rather than merely available.
Engineers
Update first, then look backward. The race needs an upgrade window, so sites that updated through the vulnerable path deserve a log review for setup-config.php requests in staging paths during the upgrade. Block or alert on public requests to upgrade staging directories, keep core, theme and plugin auto-updates on, and snapshot sites before manual upgrades so a contested upgrade can be rolled back and examined.
Everyone (non-IT)
If you run a WordPress site of your own, update it today from the dashboard and confirm the version reads 7.1.4 or the current release for your branch. Turn on automatic updates if they are off. The attack needs no password and no click from you; it only needs your site to be mid-update on an old version, which is exactly why running the update now, on your timing, is the safe move.