--- title: CISA flags WordPress RCE flaw as actively exploited in... description: CISA has confirmed active exploitation of a high-severity WordPress Core vulnerability, CVE-2026-119977, and added it to its Known Exploited Vulnerabilities... canonical: https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA flags WordPress RCE flaw as actively exploited in attacks | daily.dev og:description: CISA has confirmed active exploitation of a high-severity WordPress Core vulnerability, CVE-2026-119977, and added it to its Known Exploited Vulnerabilities... og:url: https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc og:image: https://api.daily.dev/og/posts/tTYTUOlNc.png og:image:alt: CISA flags WordPress RCE flaw as actively exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA flags WordPress RCE flaw as actively exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary CISA has confirmed active exploitation of a high-severity WordPress Core vulnerability, CVE-2026-119977, and added it to its Known Exploited Vulnerabilities catalog. The flaw is a time-of-check time-to-use race condition that lets unauthenticated attackers execute code via predictable staging paths during core upgrades. WordPress 7.1.4, released October 28, patches the issue. Wordfence says it blocked 13,095 attacks targeting this vulnerability in the past 24 hours. CISA ordered federal agencies to patch by Friday and urged all network defenders to prioritize the update. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-119977 and is it being actively exploited? CVE-2026-119977 is a high-severity WordPress Core vulnerability caused by a time-of-check time-to-use race condition in the upgrade process, letting unauthenticated attackers execute code via predictable, web-accessible staging paths during full-package core upgrades. CISA confirmed active exploitation and added it to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by a set deadline. _Teams tracking active WordPress exploits can follow the latest security disclosures on daily.dev._ ### Which WordPress version fixes the upgrade window RCE vulnerability? WordPress 7.1.4, released October 28, patches the upgrade process flaw tracked as CVE-2026-119977. The WordPress security team called it a weakness that can lead to remote code execution during the upgrade window and recommended updating sites immediately since it is a security release. _Developers deciding when to push a WordPress security update can track releases like this on daily.dev._ ### How many attacks has Wordfence blocked targeting the WordPress upgrade RCE flaw? Wordfence reported blocking 13,095 attacks targeting the WordPress upgrade window vulnerability (CVE-2026-119977) in a 24-hour period, according to an advisory update over the weekend. This followed CISA's confirmation that the flaw is being actively exploited in the wild. _Site owners gauging exploitation urgency for WordPress flaws can follow coverage like this on daily.dev._ ## Similar posts on daily.dev - [CISA warns of another cPanel plugin flaw exploited in attacks](https://daily.dev/posts/cisa-warns-of-another-cpanel-plugin-flaw-exploited-in-attacks-bkywijqt0) · BleepingComputer · 0 upvotes · 0 comments - [CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active Exploitation Evidence](https://daily.dev/posts/cisa-adds-gladinet-and-cwp-flaws-to-kev-catalog-amid-active-exploitation-evidence-jsd8w3l6v) · The Hacker News · 0 upvotes · 0 comments - [CISA orders feds to patch max severity Joomla plugin flaw by Friday](https://daily.dev/posts/cisa-orders-feds-to-patch-max-severity-joomla-plugin-flaw-by-friday-dxh7nbq8a) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA flags WordPress RCE flaw as actively exploited in attacks","url":"https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc"},"datePublished":"2026-11-04T12:13:52.377Z","dateModified":"2026-11-04T12:14:25.457Z","description":"CISA has confirmed active exploitation of a high-severity WordPress Core vulnerability, CVE-2026-119977, and added it to its Known Exploited Vulnerabilities...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/08b40e0a2ffcc11753797fe8a044072c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/08b40e0a2ffcc11753797fe8a044072c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,wordpress","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"CISA flags WordPress RCE flaw as actively exploited in attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks-ttytuolnc#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-119977 and is it being actively exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-119977 is a high-severity WordPress Core vulnerability caused by a time-of-check time-to-use race condition in the upgrade process, letting unauthenticated attackers execute code via predictable, web-accessible staging paths during full-package core upgrades. CISA confirmed active exploitation and added it to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by a set deadline. Teams tracking active WordPress exploits can follow the latest security disclosures on daily.dev."}},{"@type":"Question","name":"Which WordPress version fixes the upgrade window RCE vulnerability?","acceptedAnswer":{"@type":"Answer","text":"WordPress 7.1.4, released October 28, patches the upgrade process flaw tracked as CVE-2026-119977. The WordPress security team called it a weakness that can lead to remote code execution during the upgrade window and recommended updating sites immediately since it is a security release. Developers deciding when to push a WordPress security update can track releases like this on daily.dev."}},{"@type":"Question","name":"How many attacks has Wordfence blocked targeting the WordPress upgrade RCE flaw?","acceptedAnswer":{"@type":"Answer","text":"Wordfence reported blocking 13,095 attacks targeting the WordPress upgrade window vulnerability (CVE-2026-119977) in a 24-hour period, according to an advisory update over the weekend. This followed CISA's confirmation that the flaw is being actively exploited in the wild. Site owners gauging exploitation urgency for WordPress flaws can follow coverage like this on daily.dev."}}]} ```