CISA Flags Active Exploitation of WordPress Core Upgrade Flaw

First reported 04 Nov, 05:43 UTCSource: The Hacker NewsLast editorial activity 04 Nov, 05:43 UTCWrite a comment ↓

Close-up view of surveillance cameras during a snowfall in urban Москва setting. — Illustrative photo.Photo by Спиридон Варфаламеев on Pexels

The U.S. Cybersecurity and Infrastructure Security Agency has listed a high-severity WordPress Core flaw as actively exploited, according to a report by The Hacker News. The weakness can be abused during full-package core upgrades, when attackers may run code on a server without holding an account on the site.

Details of the vulnerability

The flaw is tracked as CVE-2026-119977 and carries a CVSS score of 8.1. It is a time-of-check time-of-use race condition, a class of bug in which the state of a resource changes between the moment it is checked and the moment it is used. The Hacker News reports that the weakness could be exploited to achieve arbitrary code execution on affected servers.

CISA said the problem stems from predictable, web-accessible staging paths used during full-package core upgrades, and that unauthenticated attackers could execute code on the server while an upgrade is under way.

Exploitation attempts and disclosure

Wordfence reported details of the flaw last week and said exploiting it does not require an account on the site, though it does require an attacker to hit a brief window during a complete Core update. In the first 21 hours after public disclosure, the WordPress security company recorded more than 18,500 requests targeting staged "setup-config.php" installer paths.

As of the time of writing, 12,632 attacks attempting to exploit the flaw had been blocked in the preceding 24 hours. Telemetry from Previdian recorded three exploitation attempts against its honeypot sensors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026.

Patches and deadline for federal agencies

Patches for the flaw were released late last month. With exploitation now confirmed by CISA, Federal Civilian Executive Branch agencies have until November 6, 2026 to apply the fixes.

Open questions

How many WordPress sites remain unpatched and exposed to the upgrade-window attack?
Have any successful compromises been confirmed beyond the blocked and attempted attacks reported so far?

Key facts

CISA has added a WordPress Core security flaw to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.

The flaw, tracked as CVE-2026-119977 with a CVSS score of 8.1, is a time-of-check time-of-use race condition that could allow code execution on affected servers.

Patches for the flaw were released late last month.

CISA said the flaw lets unauthenticated attackers execute code on the server during the upgrade window.