CISA flags WordPress RCE flaw CVE-2026-119977 for urgent patching

Key points

• CVE-2026-119977 is a WordPress remote code execution flaw.
• Releases 4.7 to 7.1.3 are in scope.
• CVSS 8.1 indicates high severity.
• CISA added it to the KEV catalog.

CISA has moved CVE-2026-119977 into its Known Exploited Vulnerabilities catalog, a step that changes the patch conversation for WordPress administrators. The flaw is a remote code execution issue with a CVSS score of 8.1, and it affects WordPress core releases from 4.7 up through 7.1.3. CISA's listing does not replace a vendor advisory, but it does mark the bug as an urgent remediation item.

Any organization running a WordPress site in that range should assume it is in scope, including K-12 district websites, school portals, department blogs, and public-facing communications pages. Version sprawl is common in education: a site may be maintained by a vendor, a regional service, or a single staff member, and staging or legacy installations are easy to overlook.

The impact matters because code execution on a web host can let an attacker move beyond the site itself, depending on server permissions and hosting architecture. A CVSS score of 8.1 is serious on its own; KEV inclusion adds urgency because it reflects known exploitation and federal remediation requirements. For a school district, an unpatched public site can become an entry point or a reputational and operational disruption.

Practical response starts with accurate inventory, not assumptions. Administrators should confirm the exact core version for every instance, apply the fixed WordPress release, and verify that no site remains in the affected range. Where immediate patching is impossible, temporary controls such as WAF rules, restricted administrative access, and heightened monitoring can reduce exposure. Watch for follow-on activity: new administrator accounts, modified files, unexpected outbound traffic, and unexplained changes to content or plugins. Treat KEV-listed flaws as deadlines, not background noise.

What to do now

1. Inventory every WordPress site and record the exact core version; include multisite, staging, and forgotten instances.
2. Apply the vendor's fixed release so no installation remains in the 4.7–7.1.3 range; test in staging, then deploy to production.
3. If patching cannot happen immediately, put the site behind a WAF with virtual patching and restrict wp-admin access by IP or SSO.
4. Enforce MFA for all administrative accounts and remove unused admin privileges.
5. Review web server and WordPress logs for unexpected file changes, new admin users, or outbound connections; isolate suspicious hosts.
6. Verify offline backups and rehearse restoration for affected sites.
7. Track CISA KEV and WordPress advisories, and set a deadline for confirming remediation.

CVE references

• CVE-2026-119977

Original source

Security Affairs