cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

CISA Confirms Active Exploitation of WordPress Core Flaw

· Original article ↗

Summary

CISA added WordPress Core flaw CVE-2026-119977 to its KEV catalog, citing active exploitation. The unauthenticated TOCTOU vulnerability can enable code execution during upgrades; patches are available, with a November 6 deadline for FCEB agencies.

Key points

  • CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
  • The high-severity TOCTOU flaw could let unauthenticated attackers execute code during a full WordPress Core upgrade.
  • The vulnerability involves predictable, web-accessible staging paths; patches were released late last month.
  • Wordfence reported more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours after disclosure.
  • Previdian observed three exploitation attempts against honeypots on October 30, 2026; Wordfence said it blocked 12,632 attempted attacks in the last 24 hours.
  • Federal Civilian Executive Branch agencies have until November 6, 2026, to apply the fixes.

Article Details

Vulnerability Types
  • Time-of-check Time-of-use (TOCTOU) race condition
Severity
High (CVSS 8.1)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers exploit the WordPress Core flaw during the upgrade window to execute code on affected servers.

CVE

CVE-2026-119977WordPress Foundation · WordPressThe high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected

Products

WordPress CoreThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

Countries

United KingdomTelemetry data from Previdian shows that three exploitation attempts have been recorded against its honeypot censors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026.

Related Articles