Following our Nov 1 item on Wordfence's exploitation-attempt data: at that point there were attempts but no confirmed compromises and no KEV listing. CISA's listing changes that. The KEV entry does not say how many sites were hit, and the ransomware-use field is "Unknown".

• Affected and fixed: per the WordPress 7.1.4 release and Wordfence's record, WordPress 4.7.0 through 7.1.3 is affected. The fix is 7.1.4, with fixed releases on older branches back to 4.7.39.
• Deadline: Nov 6, 2026 for US federal civilian agencies, with forensic triage required.

What to do: confirm every site actually finished updating (auto-updates can fail silently), deny web access to wp-content/upgrade/ at the web server, and for any site that ran a core update while still unpatched, check web logs for requests to staged files such as setup-config.php under wp-content/upgrade/ and look for unexpected PHP files or new admin users.