WordPress 7.1.4 upgrade-window RCE is now on CISA's exploited list
CISA added CVE-2026-119977, a remote code execution bug in the WordPress core upgrade process, to its Known Exploited Vulnerabilities catalog on November 3.
WordPressSecurity advisories
WordPress security advisories
Critical and actively exploited WordPress vulnerabilities in plugins, themes, core and PHP: who is affected, how to check your site, and what to do today.
Tracker
Remote code execution in WordPress
Every remote code execution bug we have written up, newest first: 1 so far. Values come from each advisory's at-a-glance table; open the advisory for the full detail and how to check your sites.
| Software | CVE | Severity | Exploited | Fixed in | Published |
|---|---|---|---|---|---|
| WordPress core | CVE-2026-119977 | CVSS 3.1 8.1, High | Exploited | 7.1.4 |