On 3 November CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities catalogue, with a remediation date of 6 November. Three days.

NVD describes it like this: "WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."

The weakness class is CWE-367, time-of-check time-of-use. The only score is 8.1 HIGH from Wordfence as a secondary source. NVD has not scored it and its record is marked Undergoing Analysis.

Read the description again and the shape of the problem appears. The hole is in the upgrade. The remediation is to upgrade. The thing you must do is the thing that opens the window.

Three days, and a forensic requirement

Under the tiering we went through when CISA retired the three-week clock, three days is the top tier, and it is reserved for flaws where exploitation gives total control. The required action on this entry names BOD 26-04 and CISA's Forensics Triage Requirements explicitly.

The catalogue now says so in a machine-readable way, and this is the part nobody has printed. The JSON carries a field called forensicTriage on all 1,767 entries: 97 say Yes, 1,670 say No.

Every single one of those 97 is a three-day entry. The earliest appeared on 25 June 2026, two weeks after the directive was published. And 150 entries name BOD 26-04 in their required action, which is exactly the number of three-day entries in the catalogue.

So the policy is now visible as data. Of the 150 flaws CISA has put on the shortest clock, 97 also require the agency to go and look for evidence that it is already too late.

WordPress Core, three times this year

This is not a first. Searching the catalogue for WordPress Core gives three entries in 2026:

  • CVE-2026-63030, added 21 July, due 24 July.
  • CVE-2026-87902, added 25 September, due 28 September.
  • CVE-2026-119977, added 3 November, due 6 November.

All three are three-day entries. All three require forensic triage. A platform that runs a very large share of the public web has been on the federal emergency tier three times in four months.

What the release note says, and what it leaves out

WordPress 7.1.4 shipped on 28 October, six days before the KEV entry, written up by Aaron Jorbin. It lists 12 security items and names no CVE for any of them.

This one appears as a line in a thank-you list: a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window, reported by Umut Bayram. There is no affected version range on the page. There is no mention of exploitation. The strongest thing it says is "Because this is a security release, it is recommended that you update your sites immediately."

Six days later CISA says it is being exploited and sets a three-day clock. Nothing in the vendor's own page would have told a reader to treat it differently from the nine stored cross-site scripting fixes beside it.

The release also says backports to older branches are still in progress, which is awkward against a 6 November deadline for anyone not on the current line.

Two details in the same release

Anthropic is credited as the reporter on two of the twelve items, both stored cross-site scripting, in Privacy Data Removal Requests and in User Logins. That is an AI company's security team in the credits of a WordPress core release, a fortnight after OpenAI's security team turned up in the Brotli advisory.

And under the non-vulnerability changes sits an update to bundled root certificates "following the eMudhra revocation". That is the same compromised intermediate certificate authority that appears in the Node.js October release. Two unrelated projects shipping the same removal inside a week is a measure of how far that one goes.

What to do

  • Update to 7.1.4. If you are on an older branch, check whether its backport has landed yet rather than assuming it has.
  • Treat automatic background updates as the mitigation they are. They close the window without a human choosing a moment.
  • If you are an FCEB agency, the deadline is 6 November and the triage requirement is part of it, not an optional extra.
  • Look at access logs for requests to upgrade staging paths. The flaw is predictable paths, so the attempts look like guesses at predictable paths.
  • Do not read a vendor release that names no CVE as a signal that nothing in it is urgent. This one carried a flaw CISA has since called exploited.

What is not established

  • How it is being exploited, or by whom. CISA records that it is, and says nothing more.
  • Whether ransomware operators are involved. The entry says Unknown.
  • Which of the twelve release items map to which CVE. WordPress does not say.
  • Why NVD has not scored it, or why the only score is a third party's.
  • How many sites are affected. Nobody has published a count.
  • What the eMudhra compromise involved. Both projects note the revocation without describing it.