# CISA adds exploited WordPress upgrade flaw to vulnerability catalog

_Published Wednesday, November 4, 2026 at 3:04 AM EST · Security · Latest · Tier 2 — Notable_

![CISA adds exploited WordPress upgrade flaw to vulnerability catalog — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9IgE0BWDAvYzjY8wFSMADIRn69AMLYxUa-oPoOISNBOpPbxwBNoWrbXWzI6P0deiU6WDqitiIZx1gFXSAlR8xX9rj56BuU48veMEPJAGSsmQTbVPirFOCuyMc_KQxtbPfc841GZGZ-3HSYYHCGbHnzrihtwQUaMlXrT3leLzI2USh00hc9OBw4k1SCJt4/s1700-nu-rw-lo-l85-e365/wp-exploit.jpg)

CISA has added WordPress Core vulnerability CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing active exploitation. Federal Civilian Executive Branch agencies must apply fixes by November 6, 2026.

The flaw allows attackers without a site account to execute server code during a brief window in a complete WordPress Core upgrade. Predictable staging paths accessible through the web create the opening. Patches were released late last month.

Wordfence recorded more than 18,500 requests targeting staged installer paths during the first 21 hours after public disclosure. Exploitation requires catching the short upgrade window.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html)

---
Canonical: https://techandbusiness.org/newswire/2f3R8CKfh1CtZ0ynOKrH83
Published: 2026-11-04T08:04:56.912Z
Story chronology: 2026-11-04T05:43:00.000Z
Retrieved: 2026-11-04T10:14:36.123Z
Publisher: Tech & Business (techandbusiness.org)