Business sites that run WordPress can protect themselves from CVE-2026-119977 by confirming they are on a fixed core version and limiting web access to the upgrade folder. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026. It is a race condition in WordPress Core during a full core update. Attackers can abuse a brief window when upgrade files sit in a predictable, web-reachable path. Federal civilian agencies have until Friday, November 6, to remediate under Binding Operational Directive 26-04. CISA also urged private-sector defenders to prioritize the same fix.
WordPress shipped the fix on October 28 in version 7.1.4, with 7.0.8 on the 7.0 branch and backports such as 6.9.11 on older supported branches. The WordPress.org release notes describe a weakness in the upgrade process that can lead to remote code execution during the upgrade window. BleepingComputer and MSP Business both report that CISA now treats the issue as actively exploited. Wordfence has reported thousands of blocked probes against the staging installer path in short windows.
This is not the older wp2shell chain from mid-2026. It is specifically the update-window race tracked as CVE-2026-119977. Automatic updates help only when they actually finish. Sites with background updates turned off, sites stuck on an old branch, and managed client sites that never got a dashboard check are the ones that still need a look today.
Open each business site and confirm the running version is 7.1.4, 7.0.8, or the fixed release for that branch. Do not assume the banner disappeared. Where the web server allows it, block PHP execution under wp-content/upgrade/. Review access logs for requests to PHP files in that folder since late October. Watch for unexpected admin accounts or new plugins after an update window.
Mabank businesses that want a quick inventory of WordPress versions across their sites can ask veteran-owned My I.T. Consultants for a Free Assessment. Call 903-675-5431 Monday through Friday from 7:00 a.m. to 6:00 p.m. Contract clients get 24/7 coverage.
Image: SI-generated illustration (My I.T. Consultants); WordPress logo: wordpress.org/about/logos
