The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog, citing evidence that attackers are actively exploiting it. The flaw, tracked as CVE-2026-119977, has a CVSS score of 8.1.
The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition that could let unauthenticated attackers execute code on affected servers during a full-package Core upgrade. CISA attributes the risk to predictable, web-accessible staging paths used during the update process. Patches were released late last month.
Wordfence previously reported that exploiting the flaw requires no site account, but does depend on attackers reaching a brief window while a complete Core update is underway. The company recorded more than 18,500 requests targeting staged “setup-config.php” installer paths in the first 21 hours after the vulnerability was publicly disclosed. It also reported blocking 12,632 attempted attacks in the 24 hours before its report was published.
Previdian telemetry recorded three exploitation attempts against its honeypot sensors on October 30, 2026, from an IP address geolocated in the United Kingdom. Following CISA’s confirmation, Federal Civilian Executive Branch agencies have until November 6, 2026, to apply the fixes.
Sources: The Hacker News.