CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers. Patches for the flaw were released late last month.

"WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window," CISA said. "This is due to predictable, web-accessible staging paths used during full-package core upgrades."

Details of the flaw emerged last week when Wordfence said exploiting the vulnerability does not require an account on the site. That said, it does require an attacker to exploit a brief window during a complete Core update that could allow unauthenticated code execution.

During the first 21 hours after public disclosure, the WordPress security company said it recorded more than 18,500 requests targeting staged "setup-config.php" installer paths. As of writing, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours.

Telemetry data from Previdian shows that three exploitation attempts have been recorded against its honeypot censors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026.

With exploitation now officially confirmed by CISA, Federal Civilian Executive Branch (FCEB) agencies have time until November 6, 2026, to apply the fixes.