Federal civilian agencies had until November 6 to close a WordPress core hole, after CISA listed it on the Known Exploited Vulnerabilities catalog on November 3. Anyone still running 4.7 through 7.1.3 is exposed too, since no login is needed to exploit it.
Tracked as CVE-2026-119977 and scored 8.1, the bug is a race condition in the full-package upgrade path. WordPress stages an upgrade in a predictable, web-accessible directory while the update runs, and an attacker who reaches the right path inside that window can get code to execute. NVD classes it as CWE-367, a time-of-check time-of-use mistake.
The fix landed in WordPress 7.1.4 on October 28 as a short-cycle security release, which also closed a stored XSS in block markup and several cross-site scripting bugs in the Interactivity API.
The window is the part defenders keep missing. Exploitation only needs the seconds or minutes a site spends copying a package into place, so any site whose update schedule coincides with a scan is a candidate, not a bystander.
Scanning began immediately. Wordfence recorded more than 18,500 requests against staging installer paths in the first 21 hours, with two large sources polling small groups of sites for about 14.5 hours to catch the brief upgrade window. Those counts measure attempts, not confirmed compromises.
Patching is not the whole job here. If a site was mid-upgrade while an attacker was probing, check for unexpected files in the staging directory and review the 7.1.4 release notes against any plugin that hooks the core updater.
