WordPress upgrade-window RCE enters KEV, update context is essential
The upgrade window deserves attention, not a panic headline about every page view. CISA added CVE-2026-119977 to KEV on November 3, 2026. Wordfence’s CNA record describes unauthenticated server-side code execution during a full-package core upgrade because staging paths are predictable and web-accessible.
Scope and severity
Wordfence assigns CVSS 3.1 8.1, with high attack complexity. Its CNA record lists affected branch ranges beginning at WordPress 4.7, including 7.1.0 through 7.1.3. Older maintained branches have individual patch ceilings, so a single comparison against 7.1.4 is not a correct universal test for backported fixes.
The vendor fix
WordPress published 7.1.4 on October 28, 2026, including a fix for the upgrade-process weakness. Its release post says security backports to eligible branches through 4.7 were in progress. That statement is not proof that every backport had shipped. The vendor also says only the most recent WordPress version is actively supported. Verify the precise branch release before treating an older installation as fixed.
Defensive work, no exploitation
Inventory core versions with the site’s normal administration tooling. Back up the site, preserve relevant upgrade and web-access logs, and update through the supported workflow. Review the timing of unexpected requests around past full-package upgrades with your incident-response team. Do not infer compromise solely from a request or safety solely from its absence.
CISA’s listed due date was November 6, 2026, already past at this catch-up check. Follow the applicable directive and triage guidance rather than treating a new article as a new remediation clock.
No staged installer requests, payloads or race procedures are supplied. The sloth verdict: finish the update, verify the version, keep the evidence.
