WordPress CVE-2026-119977 + 2 more

If you run WordPress, update to WordPress 7.1.4 (or the latest release of your branch) today and confirm in the admin screen that the update completed and the version changed. WordPress core CVE-2026-119977 was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on November 3. It lets an unauthenticated attacker run code on the server during an upgrade, so the first step is to ask your administrator or web agency about the update status. We also cover Google Chrome 157 and the November Android bulletin. Neither has any official mention of exploitation.

This digest is based on CISA KEV, NVD, the WordPress.org news post, Wordfence, Chrome Releases and the Android Security Bulletin, checked on November 4 (JST). Anything not stated is shown as "not stated." Of today's three items, one has confirmed exploitation (WordPress).

According to the CVE description in NVD (CNA: Wordfence), WordPress core has a remote code execution vulnerability in versions 4.7 through 7.1.3. The cause is described as predictable, web-accessible staging paths used during full-package core upgrades. An unauthenticated attacker could therefore execute code on the server during the short window of an upgrade. CISA lists it in KEV as a time-of-check time-of-use (TOCTOU) race condition.

- What happens: during the upgrade, an outside party may be able to run programs on your server. That could lead to site defacement or data theft. It applies when upgrading with the full package from an older version
- Severity: CVSS 3.1 8.1 (High), assigned by Wordfence. Vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning attack complexity is rated high. Weakness type CWE-367. CISA's SSVC shows exploitation=active
- Affected: every branch from 4.7.0 through 7.1.3. Examples: 7.1.0-7.1.3, 7.0.0-7.0.7, 6.9.0-6.9.10, 6.8.0-6.8.11, down to 4.7.0-4.7.38
- Fixed: WordPress 7.1.4 (released October 28). WordPress recommends updating right away. It states that fixes are being backported to every branch down to 4.7 and released in sequence. Versions 4.6 and earlier do not receive security updates
- Exploitation: added to CISA KEV on November 3. The federal agency deadline is November 6. Known ransomware use: Unknown
- Also fixed: 7.1.4 patches many stored XSS issues (blocks, Interactivity API, Customizer, user login names and more), an issue where unpublished Customizer changesets could be discovered without authentication, and an issue where unprivileged privileged users could read post notes. It also updates root certificates (for the eMudhra revocation)

In plain terms, this is the kind of flaw where the front door is unlocked only for a moment during the upgrade. It is not a hole that is open at all times, but upgrades happen regularly and an attacker can aim for that moment. That is why finishing the upgrade and verifying the result is the core of the fix.

How to check: log in to the WordPress admin screen and look at the version on the Updates screen or at the bottom of the page. 7.1.4 or later (or the fixed release of your branch, such as 7.0 or 6.9) means you are covered. Even with automatic updates on, always confirm completion. If an administrator or agency handles this for you, ask for the update date and a screenshot of the version. After updating, also check for unfamiliar administrator accounts or files. For a past WordPress remote code execution case see the WP2Shell response guide; for the risk of putting maintenance off see WordPress maintenance risk. Official: WordPress 7.1.4 announcement, CISA KEV, NVD, Wordfence

On November 3, Google promoted Chrome 157 to the Stable channel. The version is 157.0.8103.38 on Linux and 157.0.8103.38/.39 on Windows and Mac, rolling out over the coming days to weeks. It carries 213 security fixes, 7 of them Critical. Chrome does not publish CVSS scores and uses Google's own severity ratings (Critical, High and so on). Google does not state that any of these flaws are exploited in the wild.

- The 7 Critical items: CVE-2026-121156 (buffer overflow in Dawn), CVE-2026-121229 (memory corruption in ANGLE), CVE-2026-121246 (use after free in WebGL), CVE-2026-121035 (use after free in Prerender), CVE-2026-121247 (buffer overflow in Dawn), CVE-2026-121203 (use after free in Geometry), CVE-2026-121126 (use after free in Core)
- Affected: Chrome before 157.0.8103.38. All are memory-related flaws; the announcement does not give per-bug exploitation conditions
- Fixed: 157.0.8103.38 or later (Linux), 157.0.8103.38/.39 or later (Windows, Mac)
- Exploitation: Google does not state that any is exploited

How to check: open the three-dot menu at the top right, then Help, then About Google Chrome. If it shows 157.0.8103.38 or later and you have restarted, you are covered. The update needs a restart, and a browser left open for days tends to stay old. Edge and other Chromium-based browsers ship their own updates, so check each one. Official: Chrome Releases

Android published its monthly security bulletin on November 2. It has two patch levels, 2026-11-01 and 2026-11-05. A device at 2026-11-05 or later has addressed every item of the month. The bulletin does not mention limited or targeted exploitation.

- Framework RCE: CVE-2026-58868 (Critical). The bulletin says no additional execution privileges or user interaction are needed
- System RCE: CVE-2026-58876 and CVE-2026-58936 (both Critical)
- System privilege escalation: CVE-2026-55275, CVE-2026-55283, CVE-2026-58984. System denial of service: CVE-2026-58814, CVE-2026-58882
- Kernel and other privilege escalation: CVE-2026-53256, CVE-2026-89774 (Bluetooth), CVE-2026-59044 and CVE-2026-59045 (pKVM), CVE-2026-80604 (HID)
- Many more Critical items exist in the MediaTek modem and Qualcomm components
- Fixed: patch level 2026-11-05 or later
- Exploitation: the bulletin does not mention limited or targeted exploitation

How to check: open Settings, then Security (on some devices, About device), and see whether the Android security update date is 2026-11-05 or later. Delivery timing differs by manufacturer and carrier, so if it has not arrived, check their announcements. For company-issued phones, keep a list of which devices are behind. Official: Android Security Bulletin, November 2026

- Ask your administrator or web agency whether the company website runs on WordPress. If so, ask whether it is on 7.1.4 or later (or the latest release of your branch)
- Ask them to share the update date and a screen showing the version after the update
- Even if you use automatic updates, confirm that the update completed
- Ask them to check the administrator accounts for any user you do not recognize
- On company PCs, open "About Google Chrome", update to 157.0.8103.38 or later and restart
- Check the security update date on company-issued Android devices. If it is earlier than 2026-11-05, ask the manufacturer or carrier about delivery
- Record the date and the person responsible for each action

Related: WordPress WP2Shell (CVE-2026-63030) response, WordPress maintenance risk, Critical PHP flaws (CVE-2026-109618 / 109619) response. For the cost of a vulnerability assessment, see vulnerability assessment cost.

- CISA KEV: CVE-2026-119977
- NVD: CVE-2026-119977
- WordPress.org: WordPress 7.1.4
- Wordfence: CVE-2026-119977
- Chrome Releases: Stable Channel Update for Desktop
- Android Security Bulletin (November 2026)