CISA adds actively exploited WordPress flaw to KEV catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, designated CVE-2026-119977, with a CVSS score of 8.1. The flaw is a high-severity remote code execution issue affecting WordPress versions 4.7 through 7.1.3.

It stems from predictable, web-accessible staging directories used during core updates, allowing unauthenticated attackers to trigger a race condition and run malicious code on the server while an update is in progress. WordPress issued a fix in version 7.1.4, addressing the vulnerability.

Threat actors began scanning for CVE-2026-119977 soon after the security update was released. Wordfence telemetry notes more than 18,500 requests targeting vulnerable staging installer paths within the first 21 hours, illustrating exploitation attempts rather than confirmed compromises. The report quotes Wordfence describing rapid detection of new firewall rules and widespread probing of staging-directory and version-name variations, with two large sources polling small groups of sites for roughly 14.5 hours.

Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must address KEV-listed vulnerabilities by the due date to mitigate risk, and private organisations are advised to review the KEV catalog and remediate accordingly. CISA has set a fix-by date of 6 November 2026 for agencies.