Security advisory

CVE-2026-119977: the WordPress core flaw attackers are using now

On 3 November 2026 the US cybersecurity agency CISA added a WordPress core vulnerability, CVE-2026-119977, to its Known Exploited Vulnerabilities catalogue. That means attackers are already using it against real sites. If you look after WordPress sites, update them first.

The short version

  • What: a vulnerability in WordPress core, not in a plugin or theme.
  • Severity: CVSS 8.1, high.
  • Status: actively exploited, listed by CISA on 3 November 2026.
  • Fix: WordPress 7.1.4.

Check whether a site is affected

Run the site through the free WordPress check. It reads the WordPress version from the outside, lists the known core vulnerabilities for that version, and marks this one as actively exploited. Many sites hide their version; for those, check Dashboard → Updates in wp-admin.

Update safely: close the door first

The update to the fixed version is still unpacked by the old, vulnerable code, so clicking Update opens the attack window one last time. Before updating, block web access to /wp-content/upgrade/ in the server configuration:

  • nginx: location ^~ /wp-content/upgrade/ { deny all; }
  • Apache: RedirectMatch 403 ^/wp-content/upgrade/, placed above the WordPress rewrite block

A security plugin can’t block this, and neither can a .htaccess file inside that folder. Once the rule is in place, update to 7.1.4 or later, then confirm the version in Dashboard → Updates.

If you manage many client sites

Checking dozens of sites by hand after every advisory doesn’t scale. SiteOps reads the exact WordPress, plugin and theme versions from inside each site through a free, read-only connector plugin, matches them against the Wordfence Intelligence vulnerability feed, and flags anything in CISA’s actively-exploited list. You get one alert listing the affected sites, not a morning of logging in. See plans.