The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a newly identified WordPress Core vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after confirming that threat actors are actively abusing the flaw in real-world attacks.
Tracked as CVE-2026-119977 and assigned a CVSS score of 8.1, the high-severity vulnerability stems from a Time-of-Check Time-of-Use (TOCTOU) race condition that can allow attackers to execute arbitrary code on vulnerable servers. WordPress developers released security updates addressing the issue late last month.
According to CISA, the flaw exists because WordPress utilizes predictable and publicly accessible staging directories during full-package core upgrades. By targeting this narrow upgrade window, unauthenticated attackers can potentially upload and execute malicious code, resulting in server compromise without requiring valid credentials.
Additional technical details surfaced last week when Wordfence disclosed that exploitation does not depend on user authentication. Instead, attackers only need to successfully time their activity during a complete WordPress Core update process, creating a brief but exploitable opportunity for remote code execution.
Threat activity surged almost immediately following public disclosure. Wordfence reported detecting more than 18,500 exploitation attempts aimed at staged setup-config.php installation paths within the first 21 hours. The company also noted that 12,632 attack attempts targeting the vulnerability were blocked during the most recent 24-hour reporting period.
Further evidence of exploitation has been observed by Previdian, whose honeypot infrastructure recorded multiple attacks originating from a U.K.-based IP address. The incidents were logged on October 30, 2026, indicating that threat actors moved quickly to weaponize the vulnerability after details became public.
With active exploitation now formally verified, CISA has directed Federal Civilian Executive Branch (FCEB) agencies to remediate affected systems no later than November 6, 2026. Organizations running WordPress are strongly advised to apply the latest security updates immediately, as attackers continue to scan for and exploit unpatched installations.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
