CISA Gives Agencies Until Nov. 6 to Patch a WordPress Core Flaw Rated 8.1
Security / news
CISA Gives Agencies Until Nov. 6 to Patch a WordPress Core Flaw Rated 8.1
The bug only opens while WordPress unpacks its own update, yet Wordfence counted 62,969 blocked attacks in 24 hours and CISA allowed three days.
An unauthenticated remote attacker (against WordPress 4.7 through 7.1.3, and only during the seconds when a full-package core update is unpacking) can reach the installer and run PHP code on the server. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on Nov. 3 as CVE-2026-119977, with a federal remediation deadline of Nov. 6.
The fix is WordPress 7.1.4, released Oct. 28. Sites with automatic background updates should already have it, and everyone else can use Dashboard, Updates, Update Now.
What the CISA entry says
The catalog entry describes a time-of-check time-of-use race condition, meaning the system checks a condition and acts on it later, with a gap between. In CISA's words it "could allow unauthenticated attackers to execute code on the server during the upgrade window", because of "predictable, web-accessible staging paths used during full-package core upgrades."
The entry's ransomware field reads "Unknown". Its three-day deadline sits at the short end of what the catalog gave other entries this month.
| CVE | Product | Added | Federal due date |
|---|---|---|---|
| CVE-2026-109618 | PHP | Oct. 26 | Oct. 29 |
| CVE-2026-111357 | Ivanti Connect Secure | Oct. 30 | Nov. 2 |
| CVE-2026-118527 | Ivanti Connect Secure | Oct. 30 | Nov. 13 |
| CVE-2026-119977 | WordPress core | Nov. 3 | Nov. 6 |
| CVE-2024-27834 | Apple, multiple products | Nov. 4 | Nov. 18 |
The PHP entry is one of the two flaws behind the PHP2Shell fixes that skipped retired branches.
What WordPress and Wordfence each published
The WordPress 7.1.4 post lists 13 security items, 12 fixes and one bundled root certificate update. It describes "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window" and credits Umut Bayram. It gives no severity rating, no CVSS score and no affected versions, and it names no staging directory.
Those details come from Wordfence, as reported by The Hacker News on Oct. 30. Wordfence tracks the flaw as GHSA-4w3m-c66w-69mg with a CVSS score of 8.1 and says 4.7 through 7.1.3 are affected. At that point the flaw had no CVE identifier, so the CVE number reached us through the Nov. 3 catalog entry.
According to Wordfence, affected versions unpack files from a full-package core update into a predictable directory under wp-content/upgrade, and that copy includes the installer. Wordfence Threat Response Team lead Alex Thomas said an "unauthenticated attacker who requests the installer at precisely the right moment" can exploit it.
The score understates what was observed
A CVSS score of 8.1 is high but short of the 9.0 critical band, and the usual reading of that gap is that exploitation is hard. The seconds-long window supports that: Wordfence's lab observations put it at seconds in normal environments.
Attackers did not wait for it to widen. Wordfence said it blocked 62,969 attacks targeting the flaw in the 24 hours before Oct. 30, and that two of the largest sources "repeatedly polled small groups of sites for roughly 14.5 hours", which it says fits attempts to catch an upgrade in progress. Others probed paths such as setup-config.php and many staging-directory and version-name variations.
- WordPress core (added Nov. 3)3 days
- PHP CVE-2026-109618 (added Oct. 26)3 days
- Ivanti CVE-2026-118527 (added Oct. 30)14 days
- Apple CVE-2024-27834 (added Nov. 4)14 days
Source: CISA Known Exploited Vulnerabilities catalog, accessed 2026-11-05
Wordfence did not say whether any attempt succeeded, and no source we read reports a confirmed compromise. The catalog's presence is CISA's statement of exploitation evidence, and the entry does not say what that evidence was.
What operators should do
Update to 7.1.4, or to the backport for the branch in use. WordPress said fixes are being backported to every branch eligible for security fixes, through 4.7, and that the backports were still in progress when it published. WordPress 7.2 Beta 3 includes the fixes too.
One question the sources leave open is whether an update from an affected version runs through the affected upgrade code. The WordPress post does not address it, and neither it nor the coverage we read says what, if anything, an operator should do differently while that update runs.
The federal deadline for the WordPress entry falls Nov. 6, and the Apple entry added Nov. 4 runs to Nov. 18. Debian and Ubuntu hosts also have a separate apt flaw.
Sources
More in Security
- 01Apple's CVE-2024-27834, Patched in May 2024, Reaches CISA's KEV on Sekoia's Report of an APT29-Linked Web CampaignA 5.5-rated pointer authentication bypass is the second stage of an iOS 16.7 cookie-stealing chain. Sekoia's report also names a Plerdy SEO Tracker compromise and an Android chain.
- 02Plex2Shell Reached CISA's KEV 78 Days After Plex Shipped the FixFour Plex Media Server flaws chain into unauthenticated code execution on any server older than 1.43.3.10861, and attackers were installing miners within a day of a public proof of concept.
- 03CISA's BOD 26-04 Deadlines: 120 of 152 KEV Entries Since June Carry a Three-Day DeadlineThe directive that replaced BOD 22-01 on June 10 sets deadlines by exposure and exploit risk, and the catalog shows the short window is now the norm.
- 04VMware ESX Flaw Rated 2.7 Was a Zero-Day for Warp PandaCVE-2026-41709 lets an administrator skip the audit log, CrowdStrike says a China-nexus group used it in early 2026, and ESXi 7.0 has no listed fix.