The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting a recently patched, high-severity vulnerability in WordPress. Tracked as CVE-2026-119977, the flaw affects the WordPress core upgrade process and could allow an unauthenticated remote attacker to execute code on a vulnerable server.
WordPress upgrade flaw under active attack
CVE-2026-119977 is a time-of-check, time-of-use (TOCTOU) race-condition vulnerability reported by Picus Security researcher Umut Bayram.
The vulnerability is linked to the predictable, publicly accessible staging path used during a full-package WordPress core upgrade. By exploiting the race condition during the upgrade window, a remote, unprivileged attacker could potentially execute code on the server. The attack is considered complex, but successful exploitation could lead to a serious compromise.
“A vulnerability exists in the WordPress upgrade process that could allow remote code execution during the upgrade period,” the WordPress Security Team said on October 28. The team released WordPress 7.1.4 to address the issue and urged administrators to install it immediately, stating, “This is a security release, so we recommend that you update your site immediately.”
CISA adds CVE-2026-119977 to its exploited vulnerabilities catalog
On Tuesday, CISA confirmed the active exploitation of CVE-2026-119977 and added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.
Under Binding Operational Directive 26-04 (BOD 26-04), Federal Civilian Executive Branch agencies must secure affected systems by Friday. CISA warned that “these types of vulnerabilities are a frequent attack vector for malicious cyber attackers and pose significant risks to federal enterprises.”
Although BOD 26-04 applies only to U.S. federal agencies, CISA is urging all network defenders, including organizations in the private sector, to prioritize patching the vulnerability and protecting their WordPress servers.
Wordfence reports thousands of blocked attacks
CISA has not disclosed details about the attackers exploiting CVE-2026-119977. However, WordPress security company Wordfence said in a recent advisory update that it blocked 13,095 attacks targeting the vulnerability during a 24-hour period.
Earlier WordPress flaw chain led to web shells
In July, the WordPress Security Team patched a critical vulnerability chain that could be used to deploy a web shell and take over an unpatched server. The chain combined a REST API Batch Route Confusion vulnerability, tracked as CVE-2026-63030, with an SQL injection flaw tracked as CVE-2026-60137.
A public exploit known as wp2shell was released one day after the patch became available. Attackers began targeting unpatched servers days later, deploying persistent web shells and installing malicious plugins.
In September, Chinese-speaking attackers also used the wp2shell exploit chain to steal sensitive data from more than 18,500 records stored in backend databases belonging to small businesses and government agencies.
Source: www.bleepingcomputer.com