CISA Lists a Fourth WordPress Core Flaw Since July. WordPress Rates This One Low

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977, the update-window flaw fixed in WordPress 7.1.4, to its Known Exploited Vulnerabilities catalog on November 3. It is the fourth WordPress core flaw in the catalog, and all four have been added since July. The catalog gives federal civilian agencies until November 6 to fix or mitigate this one, and requires a check of affected systems for signs of compromise.

WordPress’s own GitHub advisory still labels the flaw low severity. The CVE record published by Wordfence scores it 8.1, high, with high attack complexity. CISA’s entry describes a race condition that could allow unauthenticated attackers to execute code on the server during the upgrade window.

Five of CISA’s Last 11 Additions Sit in the Shared Hosting Stack

Of the 11 flaws CISA added between October 26 and November 3, by our count five are in components commonly found on shared hosting servers:

All except Brotli carry a three-day deadline and a forensic triage requirement for agencies. A component’s presence does not by itself make a server exploitable: the Brotli flaw, for example, is triggered by a crafted compressed stream.

The earlier WordPress core entries are CVE-2026-60137 and CVE-2026-63030, added on July 21, and CVE-2026-87902, added on September 25. WordPress’s advisories label them moderate, critical and critical, so the latest entry is the only one of the four it rates low. Before July, the catalog’s entries under the WordPress name were three plugin flaws added in 2021.

What the Listing Does and Does Not Show

A catalog entry requires reliable evidence that a flaw has been exploited in the wild. CISA’s definition of exploitation covers both attempted and successful attacks, though not scanning alone, so the listing does not by itself show that WordPress sites were compromised. The entry gives no count of affected sites and marks ransomware use as unknown. As we reported on November 2, Wordfence’s figures reflected probing, and its report does not describe a successful compromise.

A severity rating and a catalog listing measure different things. CISA notes that how easily a flaw can be exploited can help determine its severity but is not a criterion for the catalog. According to Wordfence, the 8.1 score reflects the eventual impact, while an attack needs a full-package core update and must reach the staged installer in a window that lasted only seconds in lab tests. In an analysis published before the listing, Patchstack would not call the flaw practical to exploit, but noted that the window returns on every update, including unattended ones.

The November 6 deadline comes from Binding Operational Directive 26-04 and binds only federal civilian agencies, which determine each system’s final timeline based on its internet exposure. CISA strongly recommends that all organizations prioritize fixing the vulnerabilities in the catalog.

Block the Upgrade Directory at the Web Server, Then Update

Patchstack recommends denying web access to wp-content/upgrade/, a rule a host can apply to every site on a server, including sites whose automatic update has not yet run. Applied first, it also covers the update itself, because on a vulnerable site the window opens while a full-package update is being unpacked. Patchstack and Wordfence both note that the malicious request goes directly to a staged PHP file without loading the site’s WordPress, so a firewall running inside WordPress does not see it. Wordfence advises enabling Extended Protection, which lets its firewall run before such requests reach the file. Its rule reached paying customers on October 28, and users of the free version are due to receive it on November 27.

The block does not replace the fix, which is WordPress 7.1.4 or the backport release for the site’s branch, with backports reaching down to 4.7.39. For sites that stayed unpatched, Wordfence advises looking for requests to PHP files under wp-content/upgrade/, unfamiliar administrator accounts, unexpected plugins and PHP files nobody placed there.