CISA Confirms Active Exploitation of WordPress Core Vulnerability
CISA has confirmed that hackers are actively exploiting a high-severity vulnerability in WordPress Core, CVE-2026-119977, during software upgrades, urging immediate patching to prevent attacks.
CISA's Confirmation of Active Exploitation
The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are actively exploiting a high-severity vulnerability in WordPress Core, specifically CVE-2026-119977, during software upgrades. This flaw, which allows for remote code execution (RCE), has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating that it is currently being used in attacks in the wild. According to CISA, the vulnerability was patched in a recent WordPress security release, but the agency has urged all users to update their systems immediately to prevent exploitation. Federal Civilian Executive Branch (FCEB) agencies have been ordered to secure their systems by Friday, as mandated by Binding Operational Directive (BOD) 26-04. The confirmation comes from a report by Sergiu Gatlan, who noted that the flaw has already been exploited in real-world attacks.
Technical Details of the Vulnerability
The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers. This flaw, identified by Picus Security researcher Umut Bayram, stems from a weakness in the WordPress upgrade process that could allow attackers to execute arbitrary code during the upgrade window. The WordPress security team acknowledged the issue on October 28 and released WordPress 7.1.4 with patches to address the vulnerability. The flaw highlights the importance of secure software update mechanisms in content management systems.
Exploitation Attempts and Attack Statistics
CISA has confirmed that hackers are actively exploiting a critical vulnerability in WordPress Core during software upgrades. According to Wordfence, a WordPress security firm, more than 18,500 requests targeting staged "setup-config.php" installer paths were recorded within the first 21 hours after public disclosure (The Hacker News). As of the latest report, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours (The Hacker News). Wordfence also reported that it blocked 13,095 attacks targeting this vulnerability in the past 24 hours (bleepingcomputer.com). While CISA did not provide further details on the exploitation of CVE-2026-119977 in the wild, the firm has urged users to apply the latest security patches. In July, the WordPress security team also addressed a critical vulnerability chain (wp2shell) involving CVE-2026-63030 and CVE-2026-60137, which could allow attackers to deploy webshells and take over unpatched servers.
Timeline and Response from WordPress and CISA
CISA confirmed CVE-2026-119977 as actively exploited, adding the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies have until November 6, 2026, to apply fixes, as stated by CISA. While BOD 26-04 applies only to US federal agencies, CISA urged all network defenders, including those in the private sector, to prioritize patching this vulnerability to protect their servers. WordPress issued a security release, recommending that users update their sites immediately, as noted in bleepingcomputer.com. The timeline highlights the urgency of addressing this flaw, as exploitation is now officially confirmed, and the response from both CISA and WordPress underscores the importance of timely patching to mitigate risks.
Historical Context and Related Vulnerabilities
CISA has confirmed that hackers are actively exploiting a critical vulnerability in WordPress Core during software upgrades, specifically targeting CVE-2026-119977. While CISA did not provide further details on the exploitation, WordPress security firm Wordfence reported in an advisory update that it blocked 13,095 attacks targeting this vulnerability in the past 24 hours. This follows a pattern seen earlier in the year when a critical vulnerability chain, named wp2shell, was patched in July. The chain included a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137). Public exploits for wp2shell were released shortly after the patches, leading to breaches of unpatched servers. In September, a Chinese-speaking threat actor used the wp2shell exploit chain to steal sensitive data from over 18,500 records in backend databases belonging to small businesses and government organizations.
Sources and reporting notes
Based on published source material. No independent hands-on testing is claimed.
