CISA sets a Friday deadline for WordPress CVE-2026-119977

CISA has placed WordPress core flaw CVE-2026-119977 on the Known Exploited Vulnerabilities catalog. The agency added the bug on Tuesday, November 3, 2026, and confirmed that attackers are already using it. Binding Operational Directive 26-04 orders Federal Civilian Executive Branch agencies to secure affected systems by Friday, November 6. CISA is telling private-sector defenders to patch with the same urgency. A federal due date is the schedule the rest of the web should borrow.

Picus Security researcher Umut Bayram reported the flaw. It is a high-severity time-of-check, time-of-use race in WordPress core. On October 28 the WordPress security team shipped the fix in version 7.1.4 and described a weakness in the upgrade process that can become remote code execution while a full-package update is underway. An unauthenticated attacker who reaches the server in that window can run code on it. CISA has catalogued the issue as exploited in the wild.

A catalog entry, and 13,095 blocked attacks in a day

The October 28 release is the patch. The new facts are the CVE, the catalog, and the pace of the probing. Wordfence’s weekend update to its advisory reported 13,095 attacks against this vulnerability blocked in a 24-hour span. Hosts still running a build older than 7.1.4 are the population those probes are hunting.

The listing names no victim and no malware family. The listing is the signal. Catalog flaws become a shared queue for scanners, hosting abuse teams, and crews that follow the Known Exploited list. The version string is the evidence a site owner can check today.

Friday is the date

Put every public WordPress site on 7.1.4. Read the version in the dashboard or in the files on disk, then close the change ticket. Shared hosting, agency fleets, and old campaign sites use the same core updater. A managed host that updates plugins on its own still needs a core version check.

Federal civilian teams are on the Friday clock in the directive. Private teams should clear the same date. After the version reads 7.1.4, review the site for residue: administrator accounts the team cannot place, plugins nobody approved, and PHP files in the content tree. Keep logging requests that still poke the upgrade path. Those requests are reconnaissance against a host that has already moved, and they show the scanning is still underway.

This briefing relies on public reporting by BleepingComputer and on CISA’s Known Exploited Vulnerabilities catalog.