WordPress 7.1.4 Fixes CVE-2026-119977, Now on CISA KEV With a November 6 Deadline

An unauthenticated attacker who wins a short race during a WordPress core upgrade can reach PHP code execution through CVE-2026-119977, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3 with a federal due date of November 6. The fix shipped on October 28 in WordPress 7.1.4, which sites with background updates enabled should already have.

The WordPress 7.1.4 release post, published October 28 by Aaron Jorbin, lists "a weakness in the upgrade process that could lead to remote code execution during the upgrade window," credited to Umut Bayram. CISA's catalog entry gives the mechanism: predictable, web-accessible staging paths used during full-package core upgrades. It flags forensic triage as required and lists ransomware use as unknown.

The preconditions behind the score

The score and the preconditions pull in opposite directions. Rescana's write-up of the Wordfence analysis says Wordfence, which assigned the CVE, scores it CVSS 3.1 8.1 (High) with attack complexity high, while the WordPress advisory rates it Low and publishes no score. All four of these conditions must hold, per that summary:

1. A full-package core update is running.
2. The staging tree is reachable over the web with PHP execution.
3. The staging path is predictable or discovered.
4. The attacker gets in before WordPress deletes the temporary files.

The window is short. In lab tests the directory "normally remained available for only seconds," Rescana reports. The score overstates the risk for a site that is already patched and understates it for one that updates late, on a host that serves the upgrade folder.

Scanning, not confirmed compromise

Rescana, citing Wordfence, reports more than 18,500 requests aimed at staged setup-config.php paths in the first 21 hours after the fix. It also says Wordfence has published no indicators of compromise and has not reported successful compromises. It could not verify a separate figure of 62,969 blocked attacks in 24 hours attributed to The Hacker News. CISA's listing is the stronger signal: the catalog only carries flaws with evidence of exploitation, though its public entry gives no victim count.

Date (2026)	Event
October 28	WordPress 7.1.4 released, fixes backported to branches back to 4.7
October 31	CVE published (per Rescana)
November 3	CISA adds CVE-2026-119977 to KEV
November 6	Federal due date

Which versions to move to

WordPress says it backported the fixes to every branch eligible for security fixes, through 4.7, and that only the latest version is actively supported. Rescana's table gives the fixed release for each branch.

Branch	Affected	Fixed
7.1	7.1.0 to 7.1.3	7.1.4
7.0	7.0.0 to 7.0.7	7.0.8
6.9	6.9.0 to 6.9.10	6.9.11
6.8	6.8.0 to 6.8.11	6.8.12

Branches 4.6 and earlier are not listed and receive no fix.

What to do

Update to 7.1.4, or the fixed release for your branch, and confirm the version afterwards. Until then, deny web access to wp-content/upgrade/ at the web server, and check that the directory cannot be listed. Rescana notes that blocking the folder does not protect the update itself, because the installed code still unpacks the package there.

Do not rely on a PHP-level firewall alone, since the request reaches the PHP file directly rather than through WordPress. Review logs from past core updates for requests to PHP files under that folder, and look for unfamiliar admin accounts, unexpected plugins or PHP files you did not place. The same release also fixes a dozen cross-site scripting and disclosure bugs, including two credited to Anthropic.

The week's other web-server story is on a different layer: PHP2Shell and Fragnesia. For another CISA deadline that mattered to edge devices, see our note on the Cisco ASA flaw.