The Cybersecurity and Infrastructure Security Agency (CISA) has officially recognized a critical security vulnerability within WordPress Core, adding it to their Known Exploited Vulnerabilities (KEV) list. This move underscores the active exploitation of the flaw, which poses serious security risks.
Understanding the Vulnerability
Identified as CVE-2026-119977, the vulnerability carries a CVSS score of 8.1, indicating high severity. This issue, categorized as a Time-of-check Time-of-use (TOCTOU) race condition, enables attackers to perform arbitrary code execution on vulnerable servers. Patches for this flaw were made available in late October.
CISA explained that the vulnerability arises from predictable and web-accessible staging paths used during comprehensive WordPress Core upgrades. This flaw allows unauthorized users to execute code within the upgrade window without needing site credentials.
Exploitation and Impact
Wordfence, a prominent WordPress security firm, disclosed that exploiting this vulnerability does not require an account on the compromised site. However, attackers must act swiftly during a complete Core upgrade to execute unauthorized code.
Following the public disclosure, over 18,500 attempts targeted the “setup-config.php” installer paths within the first 21 hours. In a recent 24-hour period, 12,632 attack attempts were thwarted, highlighting the ongoing threat.
Global Attempts and Mitigation
Data from Previdian revealed three exploitation attempts on their honeypots, traced to a UK-based IP address, with events recorded on October 30, 2026. This global activity underscores the urgency of addressing the vulnerability.
With CISA’s confirmation of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are mandated to implement necessary patches by November 6, 2026, to protect against potential breaches.
The identification and mitigation of this vulnerability highlight the critical need for timely software updates and proactive cybersecurity measures to safeguard digital infrastructures.
