---
title: CISA adds WordPress core CVE-2026-119977 (upgrade-window RCE) to KEV with a Nov 6 deadline: update to 7.1.4 or your branch's fixed release | ctxsec
url: https://ctxsec.com/items/cisa-kev-cve-2026-119977-wordpress-upgrade-window-rce-due-nov-6
description: "CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on Nov 3, meaning it has evidence of exploitation in the wild. It is a time-of-check time-of-use race in WordPress core: during a full-package core upgrade, files are staged at predictable, web-reachable paths, and an unauthenticated attacker who hits them during that window can run code on the server. Federal agencies must act by Nov 6, and CISA also flags the entry for its forensics triage requirements."
status: "official (CISA KEV catalog 2026.11.03, added Nov 3; WordPress.org 7.1.4 release; Wordfence CNA record)"
published: 2026-11-03
---

> CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on Nov 3, meaning it has evidence of exploitation in the wild. It is a time-of-check time-of-use race in WordPress core: during a full-package core upgrade, files are staged at predictable, web-reachable paths, and an unauthenticated attacker who hits them during that window can run code on the server. Federal agencies must act by Nov 6, and CISA also flags the entry for its forensics triage requirements.

[← Cybersecurity News](/news) · [markdown](/items/cisa-kev-cve-2026-119977-wordpress-upgrade-window-rce-due-nov-6.md)

official (CISA KEV catalog 2026.11.03, added Nov 3; WordPress.org 7.1.4 release; Wordfence CNA record)

2026-11-03

### CISA adds WordPress core CVE-2026-119977 (upgrade-window RCE) to KEV with a Nov 6 deadline: update to 7.1.4 or your branch's fixed release

Following our [Nov 1 item on Wordfence's exploitation-attempt data](/items/wordfence-cve-2026-119977-wordpress-upgrade-window-rce-exploitation-attempts): at that point there were attempts but no confirmed compromises and no KEV listing. CISA's listing changes that. The KEV entry does not say how many sites were hit, and the ransomware-use field is "Unknown".

- **Affected and fixed:** per the WordPress 7.1.4 release and Wordfence's record, WordPress 4.7.0 through 7.1.3 is affected. The fix is 7.1.4, with fixed releases on older branches back to 4.7.39.
- **Deadline:** Nov 6, 2026 for US federal civilian agencies, with forensic triage required.

**What to do:** confirm every site actually finished updating (auto-updates can fail silently), deny web access to `wp-content/upgrade/` at the web server, and for any site that ran a core update while still unpatched, check web logs for requests to staged files such as `setup-config.php` under `wp-content/upgrade/` and look for unexpected PHP files or new admin users.

Sources: [CISA Known Exploited Vulnerabilities catalog (CVE-2026-119977, added Nov 3)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [WordPress.org: WordPress 7.1.4](https://wordpress.org/news/2026/10/wordpress-7-1-4/) · [Wordfence: WordPress Core 4.7.0 to 7.1.3 unauthenticated upgrade-window RCE](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution) · [NVD: CVE-2026-119977](https://nvd.nist.gov/vuln/detail/CVE-2026-119977)