CISA has placed a WordPress Core flaw on its catalog of vulnerabilities that attackers are exploiting. CISA added CVE-2026-119977 to its KEV Catalog, and the bug is a time-of-check time-of-use race condition, often shortened to TOCTOU.
The risk sits in a moment most site owners treat as routine. According to the CISA catalog entry, attackers who have not logged in could run code on the server while a core upgrade is still in progress.
Key facts
- The catalog shows the flaw was added on 2026-11-03, with a due date of 2026-11-06.
- NVD lists WordPress Core releases from 4.7 through 7.1.3 as affected.
- The NVD references point to WordPress 7.1.4, including its source code and release notice, as the fix.
- Wordfence gave the flaw a CVSS v3.1 score of 8.1, rated HIGH, according to NVD.
- The catalog entry says the problem comes from staging paths that are easy to predict and reachable over the web during upgrades.
Background
WordPress Core is the base software that every WordPress site runs on. When an owner or host runs a full-package upgrade of that software, files pass through temporary staging locations before the new version is in place.
The KEV entry says those staging paths are predictable and can be reached from the web during full-package core upgrades. That gap between the start and the end of an upgrade is the window that matters here. CISA's entry says an unauthenticated attacker could use that window to execute code on the server.
A time-of-check time-of-use flaw is a timing problem. Software checks a condition at one moment and acts on it a moment later, and an attacker who moves in between can change what happens. NVD files this weakness under CWE-367, the category for that kind of race condition.
The CVE record was published on NVD on Oct. 31, 2026, a few days before CISA added it to the catalog. CISA says flaws of this kind are a common route for malicious cyber actors.
The catalog entry carries one more detail worth noting. The KEV entry sets its forensic triage field to yes for this flaw.
What it means for you
Any site still on an affected release carries this risk each time it goes through a core upgrade. Because NVD describes 4.7 through 7.1.3 as vulnerable, the affected range spans many branches, not just the latest few, though each older branch has its own fixed release.
Attackers do not need an account on the site to take advantage of the flaw, which raises the stakes. Code running on the server can reach far beyond a single page, so the impact is not limited to how a site looks.
The federal directive tied to the catalog does not bind private businesses. BOD 26-04 applies only to Federal Civilian Executive Branch agencies, but CISA urges every organization to make fixing KEV flaws a priority. For a small business, a listing in the catalog is a strong signal that a fix should move ahead of routine work.
Many small businesses depend on an outside developer or host to manage their site. In that case, the owner still needs to know which release is live and who is responsible for the next update. A website development team can handle core updates and confirm that pages and forms still work after the change.
Some sites run custom features on top of the platform, such as booking tools or member areas. A custom app development review can check that those features still behave as expected after a core update.
Older sites can become hard to keep current over time. A guide on when to replace a business website instead of patching it walks through how to weigh that choice.
Practical steps
- Check the version. Look up the release each site runs and compare it with NVD's affected-version data, which describes 4.7 through 7.1.3 as vulnerable but also lists fixed releases on older branches.
- Update to the fixed release. Move each site to WordPress 7.1.4, which NVD references as the fix.
- Turn on automatic updates. CISA advises businesses to enable automatic updates where they can and to keep software current.
- Keep an inventory. CISA recommends a current list of approved devices and applications, with outdated ones removed. Old test sites and forgotten copies of a site belong on that list too.
- Ask vendors about updates. CISA advises confirming that vendors update their systems on a regular basis, since their weaknesses can lead to breaches. That includes web hosts and outside developers.
- Do not wait on the deadline. The catalog due date of 2026-11-06 has already passed, so sites still on an affected release are overdue by that measure.
A cybersecurity plan can help a business track urgent fixes like this one and confirm they are done. A guide to risk-based patch deadlines explains how small IT teams can rank fixes by urgency.
What happens next
The CVE record on NVD is the place to watch for changes to the affected versions or the fix. NVD's entry currently points to WordPress 7.1.4 as the fixed release.
The catalog entry is the other source to follow. CISA's KEV listing for the flaw holds the added date, the due date and the forensic triage field.
Each future core upgrade is also a chance to check that update settings work as planned. Owners who confirm the current release, the update method and the person in charge will be ready the next time a fix ships.
