The facts
BleepingComputer reported that CISA confirmed active exploitation and added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 3 November. The Canadian Centre for Cyber Security’s advisory independently lists that CISA addition. [2][3]
WordPress says release 7.1.4, issued 28 October, fixed a weakness in the upgrade process that can permit remote code execution during the upgrade window. Wordfence identifies versions through 7.1.3 as affected and lists 7.1.4 as patched. [1][4]
Wordfence reported blocking 14,024 attempts targeting the flaw in the previous 24 hours. This is vendor firewall telemetry; it does not establish that those attempts succeeded or quantify global compromises. [4]
BleepingComputer reported that CISA set a 6 November remediation deadline for U.S. federal civilian agencies and urged other network defenders to prioritize patching. [3]
Relevant context
The affected version ranges span multiple WordPress release branches. WordPress recommends immediate installation of security release 7.1.4; backported fixes for supported older branches were in progress in the release notice. [1][4]
Still unconfirmed
- CISA and the public reports reviewed do not identify the attackers or provide a count of successfully compromised sites.
- The number of internet-facing installations still vulnerable or already patched is not established by the sources reviewed.
- The specific public CISA catalog record could not be opened in this pass; the Canadian Cyber Centre advisory reports the CISA KEV addition, and BleepingComputer reports CISA’s active-exploitation warning.
Sources
References support the numbered facts above. Source checks: 4 Nov 2026, 16:18 UTC.
WordPress provides the primary patch notice; the Canadian Centre for Cyber Security’s government advisory reports CISA’s KEV action, BleepingComputer reports CISA’s active-exploitation notice, and Wordfence supplies vendor vulnerability and blocked-attempt telemetry. CISA’s own catalog page returned 403 in this check, so the story does not claim that page was read.
- WordPress 7.1.4
WordPress.org · Primary source · 28 Oct 2026
Opened the official WordPress release. It recommends immediate updating, identifies the upgrade-window remote-code-execution weakness and says security fixes were backported to eligible branches.
- WordPress security advisory (AV26-1117)
Canadian Centre for Cyber Security · Primary source · 3 Nov 2026
Opened the Canadian government cyber advisory dated 3 November. It says CISA added CVE-2026-119977 to KEV that day and identifies WordPress Core before 7.1.4 as affected.
- CISA flags WordPress RCE flaw as actively exploited in attacks
BleepingComputer · Reporting · 4 Nov 2026
Opened reporting dated 4 November. It reports CISA confirmed exploitation, added the flaw to KEV, set a federal remediation deadline and urged broader patching; specific successful compromises were not detailed.
- WordPress Core 4.7.0–7.1.3: Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
Wordfence · Primary source · 28 Oct 2026
Opened Wordfence’s vulnerability record. It describes the affected and patched versions and reports 14,024 blocked attempts in the prior 24 hours; that is the vendor’s telemetry, not a successful-compromise total.