CISA warns: An actively exploited WordPress vulnerability (CVE-2026-119977) requires an immediate update

On November 3, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added vulnerability CVE-2026-119977 to its catalog of actively exploited vulnerabilities (Known Exploited Vulnerabilities). This high-severity flaw in the WordPress core allows attackers to execute arbitrary code on the server without logging in. The deadline for federal agencies to patch this vulnerability is November 6, 2026, making it an urgent threat to Slovak and Czech websites as well.

What Happened and Why It’s Urgent

On October 28, 2026, the WordPress security team released an update that fixes 22 security vulnerabilities. The most serious of these, designated CVE-2026-119977, has a CVSS score of 8.1 out of 10.

According to records from security companies such as Wordfence, attempts to exploit this vulnerability were detected shortly after the patch was released. CISA’s alert confirms that this is not a theoretical risk, but actual, ongoing attacks. Any website that has not been updated to the patched version is currently at immediate risk of being compromised.

What Is a “Race Condition” and Why Is It Dangerous?

The CVE-2026-119977 vulnerability is classified as a race condition (specifically CWE-367: Time-of-check Time-of-use).

When updating WordPress, the average user will only notice the progress bar. Behind the scenes, however, the system extracts new core files into a temporary, predictable folder in the directory upgrade. This folder is accessible from the web for a brief window of time.

If an attacker sends a specially crafted request to the server at the exact moment this extraction is taking place, they can “beat the clock.” They can bypass the security check before it completes and inject malicious code, which is then executed with the web server’s privileges (Remote Code Execution, RCE). The attacker does not need your login credentials or any interaction from you.

Which Versions Are Vulnerable and Where Is the Fix?

The vulnerability is located directly in the WordPress core. It therefore affects every installation, regardless of which theme or plugins you use. All versions from 4.7 through 7.1.3 are vulnerable.

The WordPress team released a fix in version 7.1.4 and, as a service to users, backported it to older supported branches as well.

Source: Official WordPress.org Security Advisory, October 2026.

How to Check for and Update WordPress (Step-by-Step)

Responsibility for updates depends on your hosting type. Most managed WordPress hosting services (e.g., specialized packages) apply critical security patches automatically within 24 to 48 hours of their release. However, standard shared hosting typically places this responsibility on the user.

1. Checking the Current Version

1. Log in to your WordPress admin panel (vasadomena.sk/wp-admin).
2. Check the version number in the upper-right corner of the screen (or under Dashboard → Updates).
3. If you see version 7.1.4 (or a higher patch applicable to your branch), your site is protected.

2. Manual update (if the version is not up to date)

1. Create a backup: Before any update, create a full backup of your files and database via your hosting control panel or a plugin (e.g., UpdraftPlus).
2. Go to Dashboard → Updates.
3. If a core update is available, click the Update Now button.
4. Wait for the process to complete and check that the website is working properly.

3. Specifics of Slovak and Czech Hosting Providers

If you use services such as Websupport, Wedos, Exohosting, or Active24:

• Managed WordPress hosting: These providers usually update the core automatically. To be sure, however, contact support or check the status in their customer portal.
• Standard shared hosting: You must run the update manually using the procedure described above. The hosting provider will only automatically update PHP, not WordPress itself.

What to do if you’re using WordPress 4.6 or older

Versions 4.6 and older have not received security updates for a long time. There is no patch available for CVE-2026-119977 for these versions.

In this case, you have two options:

1. Immediate migration: Move your website to a modern hosting provider with up-to-date PHP and perform a clean installation of the latest WordPress, followed by an import of your content.
2. Temporary freeze: If migration isn’t possible immediately, disconnect the website from the public internet or protect it with strictly limited access via an IP whitelist at the web server level (e.g., via .htaccess or the hosting firewall) until a complete rebuild can be performed.