CISA has added a high-severity WordPress vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, Security Affairs reports — a listing that marks the flaw as under active attack rather than merely theoretical.
The vulnerability, CVE-2026-119977, is a remote code execution flaw carrying a CVSS base score of 8.1. It affects WordPress installations running versions 4.7 through 7.1.3, a range broad enough to put most of the installed base in scope rather than only long-neglected legacy sites. Being added to the KEV catalog signals CISA has credible evidence the flaw is being exploited in real-world attacks — a distinction that matters more to defenders than the severity score alone.
Why the KEV listing matters
The KEV catalog is maintained by CISA under a binding operational directive governing federal agencies' vulnerability remediation obligations. Entries are added when there is reliable reporting of active exploitation, and each listing carries a remediation due date that agencies must meet. In practice, the catalog has become the de facto reference point for enterprise and managed-service patch priorities well beyond the U.S. federal government, because inclusion is the closest thing to an official confirmation that a flaw is not merely theoretical.
For site operators, that shifts the calculus. A CVSS score of 8.1 describes how severe a successful attack could be; the KEV entry says attackers are already attempting it. The two together make this a patch-now item rather than one that can wait for the next maintenance window.
The deployment gap
The affected range — WordPress 4.7 all the way to 7.1.3 — spans a very large share of currently deployed sites. Notably, patch availability does not equal patch deployment: many installations, particularly older or heavily customised ones, lag releases because of plugin compatibility checks or downtime concerns.
The practical first step for fleet operators is an automated inventory scan keyed to the CVE identifier, rather than a manual check of version numbers across individual sites. Any installation within the affected window should be moved to the vendor's current fixed release as a priority. Administrators should also confirm that whatever update path they rely on has actually run; managed-hosting plans and auto-update configurations vary considerably, and a site sitting on an auto-update channel may already be remediated, while one pinned for stability almost certainly is not. The WordPress project publishes fixes through its official security releases, which site owners can follow at wordpress.org/news/category/security.
Where immediate upgrade is not feasible, applying whatever mitigations or temporary controls the vendor provides is the fallback — though no workaround should be treated as a substitute for patching.
What this story does not tell us
The report does not attribute the observed exploitation to any specific threat-actor group, and it does not indicate whether activity is targeted or opportunistic. Administrators should avoid drawing either conclusion without corroborating intelligence.
Nor does the report establish how the flaw is being reached in practice — whether through unauthenticated web requests, chained plugin flaws, or another vector — which means defenders should not narrow their detection scope based on this coverage alone.
For IT teams anywhere running self-managed or third-party-hosted WordPress estates — including in Hong Kong — the episode is a reminder that the KEV catalog has become a useful cross-check against internal vulnerability backlogs: a flaw already receiving this level of attention from CISA is one that should have been triaged within the organisation's own patch queue as well.
CISA's remediation due dates for KEV entries are published alongside each listing in the catalog and should be treated as the authoritative deadline reference for this CVE.
據 Security Affairs 報道，CISA 已將一個高嚴重性 WordPress 漏洞列入其「已知被利用漏洞」（Known Exploited Vulnerabilities，KEV）目錄——列入該名單代表漏洞正遭受積極攻擊，而非僅屬理論性風險。
該漏洞編號為 CVE-2026-119977，屬遠端代碼執行（remote code execution）漏洞，CVSS 基礎評分為 8.1。受影響範圍涵蓋 WordPress 4.7 至 7.1.3 版本，波及面之廣，意味著大部分現有安裝均在範圍之內，而不僅是長期被忽略的舊站點。列入 KEV 目錄顯示 CISA 已掌握可信證據，證明該漏洞正被用於現實攻擊——對防守方而言，這一認定比嚴重性評分本身更具意義。
為何 KEV 名單如此重要
KEV 目錄由 CISA 依據一項對聯邦機構漏洞修補義務具約束力的行動指令（operational directive）維護。當有可靠報告指出漏洞正遭積極利用時，相關條目便會被列入，而每一項名單均附有各機構必須達成的修補限期。實際上，該目錄已成為美國聯邦政府以外，企業及託管服務供應商設定修補優先次序的事實參考基準，因為獲列入目錄，幾乎等同官方確認漏洞並非僅屬理論風險。
對站點營運者而言，這改變了風險權衡。CVSS 8.1 分描述的是一旦攻擊得手的嚴重程度；KEV 條目則指出攻擊者已在嘗試利用。兩者結合，意味著這是一項須即時安裝修補程式的項目，而非可以等待下一個維護時段的項目。
部署落差
受影響範圍——由 WordPress 4.7 一直延伸至 7.1.3——涵蓋目前部署站點中極大的比例。值得留意的是，修補程式可供下載並不等於已實際部署：許多安裝，尤其較舊或高度自訂的版本，往往因 plugin 相容性檢查或停機顧慮而滯後於最新版本。
對大批量站點的營運者而言，實際上第一步是以 CVE 編號為準進行自動化清單掃描，而非逐一在各站點手動核對版本號。任何處於受影響範圍內的安裝，均應優先升級至供應商現行的已修復版本。管理員亦應確認其倚賴的更新途徑確已執行：託管方案及自動更新設定差異頗大，使用自動更新渠道的站點可能已完成修補，而為求穩定而鎖定版本的站點則幾乎肯定尚未修補。WordPress 專案會透過官方安全版本發布修復，站點負責人可於 wordpress.org/news/category/security 跟進。
若即時升級並不可行，則應套用供應商提供的緩解措施或臨時管控作權宜之計——惟任何變通方法均不能取代正式安裝修補程式。
本則報道未能說明的事
該報告並未將觀察到的利用行為歸因於任何特定威脅者組織，亦未指出相關活動屬針對性抑或機會性攻擊。管理員應避免在缺乏佐證情報下作出任何一種推斷。
報告同樣未交代漏洞在實戰中如何被觸發——是透過未經身份驗證的網頁請求、plugin 相關漏洞鏈，抑或其他攻擊向量——這意味著防守方不應僅憑此次報道收窄偵測範圍。
對各地營運自主管理或第三方託管 WordPress 環境的 IT 團隊——包括香港在內——而言，此事件提醒我們，KEV 目錄已成為對照內部漏洞待辦清單的有用參考：一個已獲 CISA 這般程度關注的漏洞，理應同樣在機構自身的修補佇列中完成分級處理。
CISA 就 KEV 條目所訂的修補限期，會與目錄內每一項條目一併公布，應視為本 CVE 的權威期限依據。