CISA Just Flagged a New WordPress Flaw as Actively Exploited — and It Hits Sites Mid-Update
By UVIDSTUDIO · November 9, 2026 · 7 min read · Cybersecurity
On November 3, 2026, CISA added a newly disclosed WordPress core vulnerability to its Known Exploited Vulnerabilities catalog after confirming real-world attacks. The twist: the bug lives in the few seconds WordPress spends updating itself. Here's what CVE-2026-119977 actually is and what a Jersey City or NYC business running WordPress should check this week.
WordPress core has an auto-update feature precisely so small-business owners who aren't developers don't have to think about patching. This week, that same mechanism turned out to be the thing attackers are exploiting.
What happened
A newly disclosed WordPress core vulnerability, tracked as CVE-2026-119977 and described as a time-of-check/time-of-use (TOCTOU) race condition, affects WordPress core versions 4.7 through 7.1.3 — in other words, nearly every version still in real-world use before this fall. The flaw sits inside the core upgrade process itself: during the brief window a site spends updating, an attacker who wins the race can get their own code to run on the server. The WordPress security team shipped a fix in WordPress 7.1.4, released October 28, 2026, along with 24 backported security releases reaching all the way back to the 4.7 branch — a sign of how broadly the affected code is shared across old and current installs alike.
On November 3, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, the designation CISA reserves for flaws it has confirmed are being exploited in the wild, not just theoretically risky ones. BleepingComputer reported that the listing set a November 6 remediation deadline for U.S. federal civilian agencies under CISA's binding operational directive — that deadline only legally applies to federal agencies, but CISA's own guidance urges every organization to treat a KEV listing as something to prioritize, not a government-only problem. Security researchers and WordPress's own firewall vendors reported blocking thousands of exploitation attempts against the vulnerable upgrade path in the days around the listing, and proof-of-concept exploit code began circulating publicly shortly after, which typically widens who's capable of attempting the attack from specialist researchers to anyone with a script.
What it means for small businesses and nonprofits in New Jersey and NYC
WordPress runs a large share of the small-business and nonprofit web — restaurant sites, law and medical practice pages, church and community-org sites, local service businesses — almost always on shared hosting nobody is actively watching day to day. The entire point of WordPress's auto-update feature is to remove the burden of remembering to patch; this flaw briefly flips that safety net into the attack surface itself, which is exactly the kind of irony that makes it worth five minutes of attention even though the exploit window during any single update is short. A compromised WordPress install for a Hudson County restaurant or a Jersey City service business doesn't just risk data — Google's Safe Browsing system can flag a hacked site within days, which tanks the local search visibility that business spent months earning, on top of whatever direct damage the compromise itself causes.
This isn't an isolated incident. It's the third WordPress-adjacent core or plugin flaw to land on CISA's exploited list since midsummer, following the wp2shell exploit chain and the unrelated PHP runtime flaws disclosed in October. The pattern across all three is the same: a brief window between disclosure and when every affected site actually gets patched, and attackers racing to hit sites that haven't closed it yet.
What to do this week
This takes minutes, not a redesign, and most of it doesn't require a developer.
- Check your WordPress version in your dashboard under Updates or Tools → Site Health, and confirm you're on 7.1.4 or the matching backported release for your branch; if you're on anything from 4.7 through 7.1.3, update now rather than waiting for the next scheduled maintenance window.
- Don't panic if auto-updates already ran — most sites with automatic background updates enabled should already be on a patched version, since WordPress pushed this as a security release; this step is about confirming, not assuming.
- If you manage hosting for a client or nonprofit board, ask your host directly whether they've confirmed every site on their shared infrastructure is patched — a vague answer is itself useful information.
- Watch for signs of compromise if you're not sure when you last updated: unfamiliar admin accounts, unexpected files in
wp-content, or a sudden Google Safe Browsing warning are the usual tells. - Treat this as a habit, not a one-time scramble — the businesses that get hurt by weeks like this one are rarely running outdated software on purpose; they've just never built a routine for patching known vulnerabilities quickly once they're disclosed.
None of this requires specialized security knowledge — it requires someone actually checking, which is the part that falls through the cracks for a lot of small teams. If you're a small business or nonprofit anywhere in Jersey City, Hudson County, or the wider NYC metro and you're not sure who's watching your WordPress site for exactly this kind of advisory, that ongoing patching and monitoring is what our cybersecurity and web design teams handle for clients — reach out and we'll tell you honestly where your site actually stands.