The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially flagged a high-severity WordPress Core vulnerability—CVE-2026-119977—as being used in live attacks. The issue, a Time-of-Check Time-of-Use (TOCTOU) race condition, allows unauthenticated attackers to execute code on vulnerable servers during a core update. The vulnerability was patched just last month.
How the Flaw Works & What Has Been Observed
This vulnerability arises when WordPress uses predictable, web-accessible staging paths during full package core upgrades. Attackers exploit the brief window in which a file like setup-config.php is accessible to run arbitrary code without needing an account. Security experts recorded over 18,500 requests shortly after the flaw was disclosed targeting this installer path, with more than 12,600 malicious attempts blocked in just one 24-hour window.
A security telemetry provider running honeypots also observed at least three exploitation attempts on October 30, 2026, traced to an IP address in the U.K. These incidents show the race window is being actively used by attackers around the world.
What CISA Requires & What End Users Should Do
CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities list and ordered federal civilian agencies to patch systems by November 6, 2026. The agency emphasizes that the vulnerability has earned a CVSS score of 8.1, classifying it as high severity given its potential for arbitrary code execution.
WordPress site operators should ensure they have the latest updates installed. Because exploitation doesn’t require authentication, even sites with usually strong access controls are at risk during upgrade windows. Patching immediately is essential.
This confirmed exploitation underlines how even well-known platforms remain vulnerable during transitional processes like upgrades. The window of opportunity in TOCTOU flaws turns routine maintenance into a target. The inclusion of this flaw in CISA’s exploited vulnerabilities catalog reflects its severity, and the forced compliance for federal agencies highlights the seriousness. Watch for broader scans and possible exploit chaining with this flaw, especially in unpatched, public-facing WordPress installations. Monitoring traffic around staging paths like setup-config.php can offer early warning signs, but only patching fully closes the risk.
