Your forgotten WordPress marketing site just landed on CISA's exploited list
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 3 November 2026. It affects WordPress Core 4.7 through 7.1.3.
Your product may not run on WordPress. Your marketing site, your docs subdomain or that campaign microsite from 2022 might. Those are usually the sites nobody owns.
What it is. During a full-package core upgrade, WordPress uses predictable, web-accessible staging paths. An unauthenticated attacker can execute code on the server during that upgrade window (a time-of-check/time-of-use race, CWE-367, CVSS 8.1).
How worried to be. The window is narrow, because the attacker has to win a race during an upgrade. The FIRST EPSS model puts the chance of exploitation in the next 30 days at about 1%. But EPSS is a prediction, and CISA lists this one as already exploited. Treat it as patch-now, not as panic.
What to do. Paste this into your tracker:
### Update WordPress: CVE-2026-119977 (exploited, CISA KEV)
**Severity:** High (CVSS 8.1). Listed by CISA as exploited on 2026-11-03.
**Check every WordPress you run, including marketing, docs, blog and old campaign sites**
- `wp core version`, or Dashboard → Updates
- Affected: 4.7 through 7.1.3
**Fix**
- Update to 7.1.4 (https://wordpress.org/news/2026/10/wordpress-7-1-4/)
- On an older branch: update to that branch's latest security release.
The fix is being backported to all supported branches, so confirm that yours has shipped.
**Also check**
- If the site went through a core upgrade while on an affected version, look for PHP files in the
web root that you don't recognise. CISA flags this entry for forensic triage.
**Done when**
- Every site reports a fixed version, and the check is recorded here.
AI-fix prompt: "List all WordPress installs in this repo and its deploy config, show the core version
of each, and open a PR or write the steps to update them to the latest security release."
Sources: CISA KEV · NVD · WordPress 7.1.4
We're building VulnTicket: verify your domain, get the holes in your site delivered as tickets like this one. It only ever tests domains you've proven are yours. Join the list.