CISA adds WordPress Core upgrade flaw to KEV catalog, citing active exploitation

CISA has added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The Hacker News reported the listing on November 4, 2026.

The flaw is a time-of-check time-of-use race condition, rated 8.1 under CVSS 3.1 by Wordfence as the CNA. CISA's description says predictable, web-accessible staging paths used during full-package core upgrades let an unauthenticated attacker execute code on the server during the upgrade window. The affected range runs from 4.7 through 7.1.3, per the CNA record.

The KEV entry was added on November 3, 2026, with a due date of November 6, 2026. CISA's required action is to apply mitigations per vendor instructions, in line with BOD 26-04, and to follow its forensics triage guidance. The catalog lists ransomware use as unknown.

What the listing doesn't tell you is who is exploiting it, against what, or how widely. The KEV entry is a statement that exploitation has been observed, not a count of victims, and nobody has published a write-up we've seen.

If you run WordPress, the first thing to check is whether core is on 7.1.4 or later, and whether any site is still mid-upgrade or holding a staging directory in the web root. The upgrade window is the part that matters here, so unattended or interrupted upgrades deserve a look.

CVE references

CVE-2026-119977