WordPress Core
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by CISA AlertsCISA adds actively exploited WordPress Core race condition flaw to its KEV catalogue
- Vulnerability reported by GBHackersWordPress core RCE flaw sees over 58,000 blocked exploit attempts
- Vulnerability reported by The Hacker NewsWordPress Core RCE flaw draws nearly 63,000 attack attempts in 24 hours
Recent news
CISA adds actively exploited WordPress Core race condition flaw to its KEV catalogue
CISA has added CVE-2026-119977, a time-of-check to time-of-use race condition in WordPress Core, to its Known Exploited Vulnerabilities catalogue on 3 November 2026. The Canadian Centre for Cyber Security's advisory AV26-1117 says WordPress Core versions before 7.1.4 are affected, so administrators should update to 7.1.4. Separately, HTTP2Shell (CVE-2026-111497), a critical remote code execution flaw in the Brotli compression library used by Node.js, Bun, Envoy and Python, was found by OpenAI's agents and is still awaiting fixes.
WordPress core RCE flaw sees over 58,000 blocked exploit attempts
Attackers are targeting an unauthenticated remote code execution vulnerability in WordPress Core, with a brief exposure window during software updates. Wordfence recorded 58,693 blocked attacks within 24 hours, though these are attempts rather than confirmed compromises. WordPress 7.1.4, released on 28 October 2026, fixes 22 security vulnerabilities.
WordPress Core RCE flaw draws nearly 63,000 attack attempts in 24 hours
A high-severity remote code execution flaw in WordPress Core affects versions 4.7 through 7.1.3, with a CVSS score of 8.1 and no CVE identifier. Threat actors began attempting exploitation shortly after patches were released, with nearly 63,000 attempts recorded in 24 hours.