The US cybersecurity agency CISA on Tuesday added a WordPress core vulnerability to its Known Exploited Vulnerabilities catalog, according to reports, based on evidence of active exploitation. The flaw, CVE-2026-119977, lets an unauthenticated attacker run code on the server, but only in a specific window: while the site is updating WordPress core.
Technically it is a race condition: during an update, WordPress extracts a temporary copy into wp-content/upgrade, and an attacker who wins the race against that extraction can reach code execution. Because of the precise timing required, WordPress rated it low severity, while Wordfence, which assigned the CVE, scored it 8.1.
Affected versions are 7.1.0–7.1.3 and 7.0.0–7.0.7; fixes are in 7.1.4, released October 28, and 7.0.8 for the older branch. One report says attackers began probing for the vulnerable path within hours of the fix. US federal agencies were told to patch by Friday.
WordPress runs roughly two in five websites, including countless Israeli small-business sites. The advice is simple: make sure your site is on 7.1.4 or 7.0.8 and keep automatic updates on. If a hosting company manages your site, check with it that the update was applied.
