WORLDTECHCISA adds WordPress code to be run remotely flaw CVE-2026-119977 to its exploited catalog
The Cybersecurity and Infrastructure Security Agency has placed a high-severity WordPress flaw, tracked as CVE-2026-119977, in its Known Exploited Vulnerabilities catalog, according to Security Affairs.
Severity and affected versions
The flaw carries a CVSS score of 8.1 and is a remote code execution vulnerability, meaning it can let someone elsewhere run programs on a machine. It affects WordPress versions 4.7 through 7.1.3. The weakness arises from predictable, web-accessible staging directories that are used while core updates are applied.
Race condition during updates
According to the report, an unauthenticated attacker could exploit a race condition to run malicious code on the server while an update is underway, a step that could compromise the website.
Fix and early scanning activity
WordPress addressed the flaw in version 7.1.4. Threat actors began scanning for CVE-2026-119977 shortly after that security update came out. Wordfence recorded more than 18,500 requests aimed at vulnerable staging installer paths within the first 21 hours. These figures document exploitation attempts, not confirmed successful compromises.
Deadline for federal agencies
CISA orders federal agencies to fix the flaw by November 6, 2026. Experts also advise private organisations to review the catalog and remediate the listed vulnerabilities in their own infrastructure.
Open questions
- How many websites have actually been compromised through this flaw?