The US Cybersecurity and Infrastructure Security Agency (CISA) says attackers are exploiting a high-severity vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, can allow unauthenticated remote actors to execute code on a server during certain upgrade operations.
The vulnerability results from a time-of-check to time-of-use race condition involving predictable, web-accessible staging paths used during full-package WordPress core upgrades. The WordPress security team addressed it in version 7.1.4, released on October 28, and recommended that site operators update promptly.
CISA confirmed active exploitation on Tuesday and added the vulnerability to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 26-04, federal civilian executive branch agencies were told to secure their systems by Friday. CISA also urged private-sector organizations and other network defenders to prioritize patching.
CISA did not provide details about the attacks. Wordfence said in an advisory update over the weekend that it had blocked 13,095 attempts targeting the vulnerability in the preceding 24 hours.
Sources: BleepingComputer.