CISA Flags WordPress CVE-2026-119977 as Actively Exploited
Summary
CISA says attackers are exploiting a high-severity WordPress Core flaw that can enable remote code execution during upgrades. WordPress patched it in version 7.1.4; CISA urges defenders to prioritize updates.
Key points
- CISA confirmed active exploitation of WordPress Core vulnerability CVE-2026-119977 and added it to its Known Exploited Vulnerabilities Catalog.
- The flaw is a time-of-check time-of-use race condition that can enable unauthenticated remote code execution during full-package core upgrades.
- Exploitation requires a high-complexity attack involving predictable, web-accessible staging paths.
- WordPress released version 7.1.4 with a patch on October 28 and recommended immediate updates.
- CISA ordered federal civilian agencies to secure their systems by Friday and urged private-sector defenders to prioritize patching.
- Wordfence reported blocking 13,095 attacks targeting the vulnerability in a 24-hour period; CISA provided no further details about the attacks.
Article Details
- Vulnerability Types
- Time-of-check time-of-use (TOCTOU) race condition
- Remote code execution
- Severity
- High
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-119977WordPress Foundation · WordPressTracked as CVE-2026-119977, this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram.CVE-2026-60137WordPress · WordPressexploiting a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137).CVE-2026-63030WordPress · WordPressand take over unpatched servers by exploiting a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137).