WordPress is on KEV. The last unpack is the race. Thursday is the clock.

CISA added CVE-2026-119977 on 3 November. Due 6 November. Forensic triage Yes. Catalog 2026.11.03 / 1767. 7.1.4 is the close. The update that installs it still unpacks through the old path.

RWP Ventures · 2026-11-04 · event 2026-11-03 · 14 min read · priority 9.1

Do not collapse five facts.

1. The overnight increment is KEV, not first disclosure. WordPress shipped 7.1.4 on 28 October. Wordfence’s firewall rule went live that evening; the first matching request arrived nine minutes later. Wordfence recorded more than 18,500 requests at staged setup-config.php installer paths in the first 21 hours. [Yesterday’s Daily Top](/posts/2026-11-03-siemens-iot2050-cve-2026-58115-nodered/) recorded catalog 2026.10.30 / 1766 with this CVE off KEV. Last night’s listing is the federal clock and the forensic-triage flag.
2. The update that closes it is still the last race. Affected versions unpack a complete package into a predictable directory under wp-content/upgrade. That tree includes the installer. On many servers it is reachable over HTTP. An unauthenticated attacker who hits the staged installer in the seconds before cleanup can progress to PHP execution. 7.1.4 randomizes the staging name, adds an index guard, and stops unsafe promotion of staged config. Until that code is running, the unpack that installs the fix still uses the old path. Blocking web access to wp-content/upgrade/ before you click Update is the control. A dashboard “Update Now” on an unpatched site is the window the scanners have been polling for.
3. WordPress rated it Low. CISA put it on a three-day clock with forensic triage. GHSA-4w3m-c66w-69mg (29 October) is Low. Attack complexity is high: full-package update, public PHP on the staging tree, a path the attacker can guess or discover, and a race measured in seconds. Impact if they win is code execution as the web server. CISA’s KEV row does not adopt the Low rating. forensicTriage is Yes. A version string is not the close.
4. Probing is CONFIRMED. A named takeover census is not. Wordfence’s 29 October post is attempts and polling, including two sources that sat on small site sets for about 14.5 hours. Wordfence has not published a confirmed site compromise. CISA’s add is evidence of exploitation under KEV criteria. Do not upgrade blocked requests into a victim count, a ransomware overlay, or a named crew.
5. This is not September’s include, and it is not yesterday’s gateway. [CVE-2026-87902](/posts/2026-09-24-wordpress-cve-2026-87902-lfi-rce/) was the 7.1.2 unauthenticated local-file include. Different bug, different close (7.1.2, 22 September). [CVE-2026-58115](/posts/2026-11-03-siemens-iot2050-cve-2026-58115-nodered/) is Siemens IoT2050 Node-RED, still not on this catalog. Do not close a WordPress hunt on an Industrial OS build, or an IoT2050 hunt on wp-includes/version.php.

The operator sentence: if a WordPress site was on 4.7 through 7.1.3 after 28 October, treat Thursday as the federal clock. Deny HTTP to wp-content/upgrade/ before you run the last unpack, confirm 7.1.4 or the branch backport, then hunt the upgrade tree and the admin list. A “updated automatically” checkbox is not forensic triage.

What happened

CISA’s 3 November KEV alert is one row.

That is the only addition since [Ivanti Connect Secure CVE-2026-111357 / CVE-2026-118527](/posts/2026-10-31-ivanti-cve-2026-111357-118527-kev/) on 30 October. Prior newest rows remain those two, then [GitLab CVE-2026-97229](/posts/2026-10-30-gitlab-cve-2026-97229-kev/) and Cisco ASA/FTD CVE-2026-76418.

Independent records fill the gap between “28 October patch” and “listed”:

• 28 October, public. WordPress 7.1.4. Security release, 22 issues. First credit: a weakness in the upgrade process that can lead to remote code execution during the upgrade window, reported by Umut Bayram (Picus Security). Backports “in progress” through 4.7. Automatic background updates start on sites that allow them.
• 28 October, ~20:30 UTC. Wordfence paid firewall rule. First match nine minutes later.
• 29 October. WordPress publishes GHSA-4w3m-c66w-69mg, severity Low. Wordfence publishes the RCE analysis: >18,500 staged-installer requests in 21 hours; two large sources polled small site groups for ~14.5 hours.
• 30 October. Secondary reporting (SecurityWeek, later THN amplification) cites Wordfence telemetry near 62,969 blocked attempts in 24 hours. Still no Wordfence-reported confirmed compromise.
• 31 October. Wordfence as CNA publishes CVE-2026-119977. NVD lists it the same day. NVD has not assigned its own CVSS as of this writing.
• 3 November, 20:00 UTC. CISA catalog 2026.11.03 / 1767. One row. Forensic triage Yes. Due 6 November.

CISA has not published a victim census, actor name, or ransomware overlay with the add. Wordfence has not attributed the polling sources. Do not invent either.

Same calendar day, different ticket: CISA also published ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center (Energy / Critical Manufacturing). CVSS 9.0 adjacent-network SQLi and incorrect authorization. Not remotely exploitable. No known public exploitation. That is an ICS advisory, not this KEV.

Why it matters

Three operational reasons this is the daily.

First: the CMS is the estate. WordPress is the public site, the intranet, the vendor portal, and the forgotten marketing box that still has an admin ajax endpoint. Unauthenticated code execution as the PHP user is web-shell, plugin implant, and credential theft even when it is not root. BOD 26-04 forensic triage is the right flag for that class.

Second: the patch ritual is the exploit window. Most WordPress security bugs are “update and you’re done.” This one inverts it. The last vulnerable unpack is the one that installs 7.1.4. Scanners have been sitting on wp-content/upgrade/ since the night of the release. Hosts that auto-updated in the background may already be past the race — if the update finished. Hosts that still show 7.1.3, or a 4.7–7.0 branch below the backport, still have to cross it. A WAF that loads with WordPress does not see a request that goes straight at a staged PHP file. Wordfence said that out loud on 29 October: Extended Protection, or a server-level deny on /wp-content/upgrade/, or you are watching the wrong log.

Third: the public probing pre-dates KEV by six days. Wordfence’s first match was 28 October. CISA listed it 3 November. Thursday’s due date is an FCEB clock, not the start of exploitation. [CVE-2026-87902](/posts/2026-09-24-wordpress-cve-2026-87902-lfi-rce/) already taught this desk that “WordPress Core, unauthenticated, attackers writing PHP” is a live pattern this fall. This is a different CVE. It is the same class of asset.

Who / what is affected

Confirmed in scope (Wordfence CNA / NVD / GHSA):

• WordPress Core 4.7.0 through 7.1.3, every security-supported branch in that range.
• Current-line fix: 7.1.4 (28 October).
• Branch floors, matching Wordfence and GHSA: 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15, 6.1.16, 6.0.18, 5.9.20, 5.8.19, 5.7.21, 5.6.23, 5.5.24, 5.4.25, 5.3.27, 5.2.30, 5.1.28, 5.0.31, 4.9.35, 4.8.34, 4.7.39.
• Prerequisite: a full-package core update (complete WordPress package, not a files-only overlay), web and PHP access to the staging tree, and the attacker winning the race. Attack complexity High.

Confirmed not a substitute for the Core bump:

• WordPress.com hosted sites, per usual hosted-platform handling — still confirm with the host. Self-hosted, VIP-adjacent, and “managed WP” that still run Core on your PHP are in scope until the platform says otherwise.
• A security plugin, including Wordfence Free until 27 November (30-day rule delay). The paid rule is not 7.1.4.
• WordPress 4.6 and earlier. Those branches no longer receive security updates. The close is a supported release, not a backport that does not exist.

Confirmed not this CVE:

• [CVE-2026-87902](/posts/2026-09-24-wordpress-cve-2026-87902-lfi-rce/) (7.1.2 unauthenticated include).
• Plugin/theme RCEs from the same week. This row is Core.
• [CVE-2026-58115](/posts/2026-11-03-siemens-iot2050-cve-2026-58115-nodered/) IoT2050 Node-RED. Not in catalog 2026.11.03.
• ICSA-26-307-01 PowerSYSTEM Center. No KEV row, not remote, no exploitation reported.

UNKNOWN / not validated:

• How many sites were successfully taken over. Wordfence reports attempts. CISA reports exploitation evidence. Neither published a victim list.
• Whether auto-update coverage actually reached locked-down, composer-managed, or image-pinned fleets.
• Ransomware use. Catalog says Unknown.

Technical context

High level. This is not a how-to.

During a full-package core update, affected WordPress extracts the new tree into a directory under wp-content/upgrade. Before 7.1.4 that directory name was predictable, and on default configs the folder is inside the web root. The staged copy includes installer PHP (setup-config.php and related). An unauthenticated GET/POST that lands on that PHP in the seconds between unpack and cleanup is interacting with a temporary WordPress, not the live wp-config.php in the way the operator thinks. WordPress’s own GHSA sentence is enough: an unauthenticated attacker who wins the race against that extraction could reach remote code execution.

7.1.4 changes three things Wordfence names: random staging directory, index guard, no unsafe promotion of staged configuration. The files that change include class-wp-upgrader.php and update-core.php. That is why a plugin bump does not close it, and why a WAF that only sees requests WordPress bootstrapped can miss it.

Hunt seeds (not a closed set, not a PoC):

ATT&CK mapping (assessed from the public records, not a CISA assignment): T1190 Exploit Public-Facing Application; T1059.006 Python is not this (PHP); T1505.003 Web Shell as a possible follow-on, not demonstrated in the Wordfence post; T1608 Stage Capabilities only as the attacker’s polling of the upgrade path.

Threat / exploitation status

What defenders should do

1. Inventory the running Core, not the last ticket. wp core version, Dashboard → Updates, or wp-includes/version.php. Map every self-hosted, composer-pinned, Docker, and “managed” instance to the branch floor. 4.6 and earlier are unsupported; plan the upgrade, do not wait for a 4.6.x tag.
2. If you are still on 4.7–7.1.3, deny HTTP to wp-content/upgrade/ first. Web-server deny, WAF path block, or equivalent. Then run the update. Then confirm the version. Then you can lift the deny if you must; leaving it blocked is cheaper. Sites that already show 7.1.4 / the backport are past the last vulnerable unpack — still hunt (step 4).
3. Do not treat a WordPress-bootstrapped WAF as coverage for this request. Wordfence: the exploit hits a staged PHP file without loading WordPress. Extended Protection / server-level deny, or you are not in the path. Wordfence Free does not get the 28 October rule until 27 November. The rule is not the patch.
4. Forensic triage is Yes. If the site was on an affected build after 28 October and wp-content/upgrade/ was web-reachable, hunt before you declare the ticket closed: requests to PHP under that tree; leftover staging directories; unexpected admins, plugins, mu-plugins, and PHP in uploads; outbound beacons you did not design. Rotate application passwords, salts if you have reason, and any secrets that lived in wp-config.php or the database. A clean version string after the fact does not rewind a won race.
5. Confirm auto-update actually ran. Background updates are the default for most site owners and not a guarantee for locked images, host-delayed rings, or fleets that pin Core. Check the version. Do not check the checkbox.
6. Keep yesterday’s OT ticket and this CMS ticket apart. IoT2050 CVE-2026-58115 is still not KEV. PowerSYSTEM Center is an adjacent-network ICS advisory with no exploitation. Ivanti 111357 was due 2 November. GitLab 97229 was due 1 November. None of those are this hunt.

RWP assessment

This is the daily because it is the only new CISA KEV row since 30 October, it carries forensic triage, the due date is Thursday, and the asset class is every internet-facing WordPress this desk’s readers actually run. Evidence quality is high on the vulnerability, the patch, the catalog increment, and mass probing (WordPress + Wordfence + live KEV JSON). Evidence quality is low on confirmed takeovers, actor identity, and ransomware. We are not calling a mass-compromise event from blocked requests, not collapsing this into CVE-2026-87902, not folding Siemens 58115 into the catalog, and not treating WordPress’s Low rating as the operational priority.

Score 9.1. It outranks Subnet PowerSYSTEM Center ICSA-26-307-01 (CVSS 9.0, adjacent, authenticated, no exploitation, not remote), repeating Ivanti 111357 / GitLab 97229 / Plex / Software Center due-date clocks (already published; no new rows), remaining 58115 coverage (yesterday’s daily; still off KEV), Bitdefender’s 3AM/AI-assisted school-estate reporting (interesting, not a federal three-day CMS clock), and Langflow criticals without a KEV row.

What we are watching

• Whether Wordfence, a hoster, or a national CERT names a confirmed takeover, not another probe tally.
• Whether ransomware use flips off Unknown.
• Whether WordPress revises GHSA-4w3m-c66w-69mg off Low now that the CVE and KEV exist.
• Whether CVE-2026-58115 (IoT2050 Node-RED) lands on KEV.
• Catalog increment past 2026.11.03 / 1767.
• FCEB clock that hits Thursday 6 November: this row. Brotli CVE-2026-111497 and Adobe Commerce CVE-2026-48356 due 10 November. Ivanti CVE-2026-118527 due 13 November. VMware ESX CVE-2026-41709 due 11 November.

Sources

• CISA — Adds One Known Exploited Vulnerability to Catalog, 3 November 2026
• CISA — KEV JSON feed
• CISA — Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04 implementation guidance
• WordPress — 7.1.4 security release, 28 October 2026
• WordPress — Version 7.1.4 documentation
• WordPress — GHSA-4w3m-c66w-69mg
• Wordfence — 7.1.4 security release RCE, 29 October 2026
• Wordfence — Core 4.7.0–7.1.3 unauthenticated upgrade-window staged-installer RCE
• NVD — CVE-2026-119977
• CVE — CVE-2026-119977
• SecurityWeek — Fresh WordPress Vulnerability in Attackers' Crosshairs
• CISA — ICSA-26-307-01 Subnet Solutions PowerSYSTEM Center
• [RWP — WordPress 7.1.2 LFI, 24 September 2026](/posts/2026-09-24-wordpress-cve-2026-87902-lfi-rce/)
• [RWP — Siemens IoT2050 Node-RED, 3 November 2026](/posts/2026-11-03-siemens-iot2050-cve-2026-58115-nodered/)
• [RWP — GitLab CVE-2026-97229 KEV, 30 October 2026](/posts/2026-10-30-gitlab-cve-2026-97229-kev/)