CISA lists WordPress Core 4.7 to 7.1.3 upgrade-window RCE CVE-2026-119977 as exploited, due 6 November. The fixed build for every branch, and how to check yours.
CISA added a WordPress Core remote code execution flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog on 3 November 2026, with a federal remediation due date of 6 November. Every WordPress release from 4.7 through 7.1.3 is affected, and the fix is WordPress 7.1.4 or the matching security release for older branches. CISA's SSVC data in NVD records exploitation as "active".
What is affected
NVD's record says WordPress Core 4.7 through 7.1.3 is vulnerable "due to predictable, web-accessible staging paths used during full-package core upgrades". An unauthenticated attacker can execute code on the server during the upgrade window. The CNA, Wordfence, scored it CVSS 3.1 8.1 (High): network vector, no privileges, no user interaction, but attack complexity High. That rating fits a flaw that only exists while a core upgrade is in progress. CISA classes it as CWE-367, a time-of-check time-of-use race, and its KEV entry is titled "WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability".
NVD published the record on 31 October. In KEV, known ransomware campaign use is "Unknown". No source we read names an attacker or campaign, and this article does not either.
How the fix and the CVE are linked
The WordPress 7.1.4 announcement of 28 October does not name a CVE. It lists "a weakness in the upgrade process that could allow remote code execution during the upgrade window" among the fixes. The match to CVE-2026-119977 rests on NVD's references, which list that post as the release note and point to Trac lines in the 7.1.4 tag (class-wp-upgrader.php and update-core.php) as the patch. We could not open the Trac pages or the Wordfence advisory, so the exact mechanism is not described here.
The same release also fixes a batch of stored XSS issues, an Interactivity API denial of service, exposure of unpublished Customizer changesets and a bundled root certificate update, so it is worth installing for more than this one flaw.
Fixed builds per branch
The WordPress.org version-check API and the releases page both listed, on 5 November, a release for every branch below. NVD's configuration data gives the same numbers as the first non-vulnerable build in each branch. Anything older than the build listed for your branch is affected.
| Branch | Fixed build |
|---|---|
| 7.1 | 7.1.4 |
| 7.0 | 7.0.8 |
| 6.9 / 6.8 / 6.7 / 6.6 | 6.9.11 / 6.8.12 / 6.7.11 / 6.6.11 |
| 6.5 / 6.4 / 6.3 / 6.2 | 6.5.14 / 6.4.14 / 6.3.14 / 6.2.15 |
| 6.1 / 6.0 | 6.1.16 / 6.0.18 |
| 5.9 / 5.8 / 5.7 / 5.6 | 5.9.20 / 5.8.19 / 5.7.21 / 5.6.23 |
| 5.5 / 5.4 / 5.3 / 5.2 | 5.5.24 / 5.4.25 / 5.3.27 / 5.2.30 |
| 5.1 / 5.0 | 5.1.28 / 5.0.31 |
| 4.9 / 4.8 / 4.7 | 4.9.35 / 4.8.34 / 4.7.39 |
The 7.1.4 announcement said the backports were still in progress when it was published. They are now available.
From the WordPress 7.1.4 release to the federal remediation deadline.
What defenders should do
- Check your version. In the dashboard, open Dashboard > Updates, which shows the installed version. With WP-CLI, run
wp core version. Compare the result with the table above. - Update now. Use Dashboard > Updates > Update Now, or run
wp core updateto fetch the latest release for your install. Sites with background updates enabled may already have moved, but confirm it. For a pinned older branch, usewp core update --version=<fixed build>with the number from the table. - Treat the upgrade itself as the risky moment. The flaw lives in the upgrade window, so schedule updates promptly and do not leave a half-finished upgrade sitting on a public site.
- Triage for compromise if you were exposed. The KEV entry flags forensic triage as required and cites CISA's BOD 26-04 and its forensic triage requirements. We found no public indicators of compromise as of 5 November 2026, and we will not guess at any. Preserve logs and file listings, and follow CISA's triage guidance for any system that was reachable during an upgrade before it was patched.
Federal agencies have until 6 November. Everyone else has the same flaw and the same fix. Our earlier WordPress core coverage, CVE-2026-87902, is a separate issue.