The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a recently patched, high-severity vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, can allow unauthenticated remote attackers to execute code on affected servers. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal civilian agencies to address it by Friday under Binding Operational Directive 26-04. The warning highlights how quickly attackers move from public patch information to real-world exploitation.
The vulnerability is caused by a Time-of-check Time-of-use (TOCTOU) race condition in WordPress’s upgrade process. It was reported by Picus Security researcher Umut Bayram and relates to predictable, web-accessible staging paths used during full-package core upgrades. During the upgrade window, an attacker may be able to interfere with the process and achieve remote code execution. Although exploitation is described as high-complexity, the potential impact is serious because successful attacks do not require prior privileges on the server.
WordPress released version 7.1.4 on October 28 to fix the issue, urging administrators to update their sites immediately because it was a security release. CISA later confirmed evidence of active exploitation and emphasized that such vulnerabilities are a frequent attack vector for malicious cyber actors, posing significant risks to the federal enterprise. While the federal directive applies only to U.S. federal agencies, CISA also urged private-sector organizations and other network defenders to prioritize patching their WordPress installations.
The scale of attempted attacks appears substantial. According to WordPress security firm Wordfence, it blocked 13,095 attacks targeting the vulnerability within a 24-hour period. CISA has not publicly disclosed detailed information about the threat actors, targets, or post-exploitation activity. Even so, the volume of blocked attacks suggests that adversaries are scanning broadly for vulnerable WordPress sites rather than focusing on a small number of high-value targets.
The incident follows earlier WordPress security concerns, including the “wp2shell” vulnerability chain patched in July. That chain combined a REST API batch-route confusion flaw and an SQL injection vulnerability to deploy webshells and take over unpatched servers. Public exploit code appeared shortly after the fix, and attackers later used the technique to install malicious plugins and steal database records. Together, these cases reinforce an essential lesson for site owners: apply WordPress core and plugin updates promptly, restrict administrative access, monitor upgrade activity, and maintain reliable backups to reduce the impact of exploitation.
Read the original article: