Update WordPress now: CISA confirms remote execution vulnerability actively exploited

The Cybersecurity and Infrastructure Security Agency (CISA), which calls itself “America’s Cyber Defense Agency”, has added a high-severity WordPress remote code execution threat to its known exploited vulnerabilities database.

Described by the WordPress security team as a “weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window,” CVE-2026-119977 has already been patched. But update now. If you haven’t, then the CISA reports that attackers are already out there exploiting your apathy.

Patching to WordPress 7.1.4 closes the window, said BreachLock CEO Seemant Sehgal, but teams still need to be aware of what this touches in their environment. “Any site that ran a WordPress update before patching to 7.1.4 should look for unexpected files in the staging directories, unknown admin users, modified theme or plugin code, and outbound traffic from the web server that doesn’t match normal patterns.”

This kind of race condition vulnerability allows an attacker to execute malicious code on a web server without any login required. As Sehgal pointed out, on most WordPress sites, this “is also where the database credentials and admin access live”.

More WordPress exploits could follow

Unfortunately, CVE-2026-119977 could be just the start of your WordPress problems.

John Strand of Black Hills Information Security, warned that: “Like the Eye of Sauron, the attention of hackers, security professionals, and researchers is now fixed on WordPress. We see this all the time. One vulnerability comes to light, and suddenly there’s a pig pile of people digging into the same technology, especially when it involves encoding and decoding or compressing and decompressing data.”

Umut Bayram, the security researcher at Picus Security who discovered and disclosed the vulnerability, told TechFinitive that AI tooling such as Mythos-class models, “put this kind of research within reach of far more people, attackers included. If an early-career researcher can find a two-decade-old RCE in an afternoon, so can an attacker.”

Despite this CVE being patched, updating is never as easy in the real world as we, the media, sometimes signal it to be. “Anyone who runs production knows updating is rarely fast or simple,” Bayram said, adding that this leaves a window where you and your organisation are exposed; a window that attackers are leveraging.

“That’s why validation can’t wait for the next scheduled test anymore,” Bayram advised, “it should start when something changes. A new CVE drops, an advisory comes out, someone changes a firewall rule. That’s the signal, and that’s when you need to find out whether you’re exploitable and whether your controls would actually stop it.”

More security-related articles

• PHP problems were just the start: You need to start planning for a winter of discontent
• Is cybersecurity losing the race against AI adoption?
• Europe’s supermarket fridge attacks expose growing risks to connected infrastructure