■ ARISTA CVE-2026-114625 · Fixed■ CISCO CVE-2026-76519 · Fixed■ CITRIX CVE-2026-88779 · Fixed■ COLLABORA CVE-2026-110447 · Fixed■ FORTINET CVE-2026-104286 · Fixed■ GITLAB CVE-2026-97229 · Fixed■ MICROSOFT KB5127648 · Confirmed by Microsoft (Oct 20)■ MICROSOFT KB5127648 · Fixed in October 13 updates■ ORACLE CVE-2026-75803 · Released 2026-10-20■ PALO ALTO CVE-2026-0322 · Fixed■ PALO ALTO CVE-2026-109618 · Fixed■ PLEX CVE-2026-96652 · Fixed■ SAP GHSA-4mv3-jxxm-9cx2 · Patches released 2026-10-13■ SONICWALL CVE-2026-19868 · Fixed■ VMWARE/BROADCOM KB 455737 · No critical release in October■ MICROSOFT KB5124010 · Mitigated (workaround only■ WORDPRESS CVE-2026-119977 · Fixed

← All impacts

WordPress

WordPress Core: unauthenticated RCE during upgrade window (CVE-2026-119977), on CISA KEV

Fixed

TL;DR: CVE-2026-119977 is an unauthenticated remote code execution weakness in the WordPress core upgrade process. During a full-package upgrade window, predictable web-accessible staging paths can let an attacker run code on the server. WordPress 7.1.4 (Oct 28, 2026) fixes it and backports security updates through 4.7. CISA added the CVE to KEV on Nov 3 with a Nov 6 due date. Update now. (WordPress, CVE, CISA)

Item Detail Source
CVE / severity CVE-2026-119977, High, CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Title: Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution CVE record
Impact Weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window, via predictable web-accessible staging paths during full-package core upgrades. Reporter: Umut Bayram WordPress, CVE record
Affected WordPress Core 4.7 through 7.1.3 CVE record
Fixed in WordPress 7.1.4 (released Oct 28, 2026); security fixes backported through 4.7. WordPress recommends immediate update WordPress
Exploitation CISA added CVE-2026-119977 to KEV on Nov 3, 2026, citing evidence of active exploitation. Federal due date: Nov 6, 2026. Forensic triage: Yes. Ransomware use: Unknown CISA alert, CISA KEV

What to do

  • Update to WordPress 7.1.4 or the matching fixed branch backport for your release line. (WordPress)
  • Until updated, MoonSec analysis: limit web access to upgrade staging paths during full-package core upgrades (for example under wp-content/upgrade/) where the host allows it. That is hardening, not a substitute for the security release.
  • Federal/BOD 26-04 stakeholders: due date was Nov 6, 2026; forensic triage is required under the KEV entry. (CISA KEV)

Why it matters

MoonSec analysis: An unauthenticated RCE path that opens only during the upgrade window is easy to miss in routine patch calendars. Qualification is CISA KEV / active exploitation evidence, not a vendor Critical label or CVSS 9+. Sites still on 7.1.3 or older branch builds should treat 7.1.4 (or the matching backport) as urgent.

Last verified 2026-11-06Report an error: [email protected]