An upgrade window can be an attack window. CISA has added a WordPress Core flaw to KEV, making upgrade safety part of the remediation task.
CVE-2026-119977 · NEW KEV addition: November 3, 2026. The WordPress 7.1.4 security release was published October 28. The new fact is CISA’s confirmation of known exploitation, not a newly released patch.
Applicability and fix
CISA describes a race condition involving predictable, web-accessible staging paths during full-package WordPress Core upgrades. An unauthenticated attacker can execute server-side code during that window. Inventory self-hosted and managed WordPress installations and confirm the actual upgrade mechanism with each hosting provider; this review does not establish exposure of any particular site or customer.
WordPress confirms that 7.1.4 fixes the upgrade-process weakness and recommends immediate updates through Dashboard → Updates → Update Now or the official download. Its announcement says security backports through the 4.7 branch are in progress; it does not enumerate their currently available fixed builds. A complete affected-version matrix and vendor severity/CVSS score were not verified. Do not assume an older branch is fixed merely because it accepts automatic updates.
Exploitation and federal requirements
CISA KEV confirms exploitation; ransomware campaign use is Unknown. The federal remediation deadline is November 6, 2026, and the catalog marks forensic triage: Yes with linked federal guidance. These federal requirements are not a customer-specific deadline assigned to Brian. The reviewed WordPress announcement does not provide product-specific indicators or a mandatory credential-rotation procedure.
Suggested MSP priority: Urgent if applicable
Inventory → record core version, owner, hosting model, upgrade path and external reachability across the customer inventory.
Contain → preserve relevant evidence if compromise is suspected. Consider restricting untrusted web access for the maintenance window while validating the upgrade procedure. This is suggested exposure reduction, not a vendor-verified complete workaround.
Patch → use the supported WordPress update or hosting-provider path to 7.1.4 or a verified branch-specific security backport. Obtain provider confirmation for managed sites. Do not treat successful patching as proof that prior exploitation did not occur.
Verify → confirm the running core build and update completion, review upgrade-related web/file activity where records exist, and test site and administration functions. Investigate suspicious changes through incident response; rotate credentials when warranted by evidence and recovery guidance.
Official sources
WordPress 7.1.4 security release, October 28 · CISA official KEV JSON · CISA KEV catalog · CISA federal forensic-triage guidance
Last verified: November 3, 2026. Applicability, older-branch backports and provider remediation require validation. No customer systems were changed.