WordPress Core RCE Added to CISA KEV as Exploitation Is Confirmed

CISA confirms active exploitation of WordPress CVE-2026-119977 RCE; patch to 7.1.4, hunt webshells, review Apple KEV CVE-2024-27834.

• CISA added CVE-2026-119977 (CVSS 8.1), an unauthenticated remote code execution flaw in WordPress core, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation.
• WordPress 7.1.4 and backported fixes address the issue; available remediation guidance lists installations from 4.7 through 7.1.3 as the range to eliminate, so verify exact branch coverage with WordPress.
• School and government WordPress sites, including multisite, staging and vendor-hosted instances, are exposed; compromise can lead to webshells, admin takeover and access to student or staff data.

What to do now

1. Inventory every WordPress Core installation now, including multisite networks, staging sites, departmental blogs and vendor-hosted sites; record exact core version, owner and internet exposure.
2. Apply the vendor fix immediately: upgrade to WordPress 7.1.4 or later, or install the WordPress-supplied backport for supported older branches; then verify the version and remove or isolate unsupported installations.
3. While patching is completed, add WAF virtual patching for WordPress administration and upgrade surfaces, restrict wp-admin access by source IP or SSO, enforce MFA and remove unused administrator accounts.
4. Hunt web, application and authentication logs for probing, unusual POST requests, new admin users, file changes, webshell indicators and unexplained outbound connections; preserve evidence before cleanup.
5. For any suspected compromise, rotate WordPress salts, admin and database credentials, rebuild from known-good files or backups, and track KEV remediation to completion; apply the same urgency to Apple CVE-2024-27834 on managed endpoints.

Related items

• U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
• Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
• Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach
• CISA Adds One Known Exploited Vulnerability to Catalog
• CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
• CISA flags WordPress RCE flaw as actively exploited in attacks
• Attackers Actively Probing for Upgrade-Window RCE Vulnerability in WordPress Core
• U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog