CISA Confirms Active Exploitation Of WordPress Core Upgrade Flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Security researchers track the flaw as CVE-2026-119977, which carries a CVSS score of 8.1 and affects WordPress Core versions 4.7 through 7.1.3.

The vulnerability allows unauthenticated attackers to run code on a server, but only during the brief window when WordPress installs a full Core upgrade. With exploitation now confirmed, CISA has given Federal Civilian Executive Branch (FCEB) agencies until November 6, 2026, to apply the available fixes.

CISA describes the bug as a time-of-check time-of-use (TOCTOU) race condition, a weakness that MITRE catalogs under the identifier CWE-367. In its official alert, CISA stated, "This is due to predictable, web-accessible staging paths used during full-package core upgrades." During a full-package upgrade, affected versions unpack the new files, including the WordPress installer, into a predictable directory under wp-content/upgrade.

Many web servers expose the staging directory to the public, so anyone who knows or can guess the path can request the staged installer directly. An attacker who reaches the installer at the right moment can interact with the temporary WordPress copy and proceed to execute PHP code.

Successful exploitation does not require an account on the target site, but the attacker must satisfy several conditions before WordPress removes the temporary files. Wordfence notes that the window lasts only seconds in normal lab environments, which makes the attack difficult but far from impossible. According to Wordfence, an attacker can only win the race and execute code on the server when all of the following conditions apply:

• The site receives a full-package update that includes the installer files.
• The staging tree allows public web access and PHP execution.
• The attacker knows or discovers the staging path.
• The attacker completes the attack before WordPress cleans up the temporary files.

The WordPress project released version 7.1.4 on October 28, 2026, and the update fixes 22 security vulnerabilities, including this upgrade-window flaw. Wordfence notes that site owners on older branches should install the corresponding security release for their branch rather than staying on an unpatched build. Threat actors began probing the flaw almost immediately, and Wordfence recorded more than 18,500 requests against staged setup-config.php installer paths within 21 hours of disclosure.

By October 30, the company's firewall had blocked 62,969 attacks targeting the vulnerability over a single 24-hour period across the sites it protects. As of November 4, Wordfence had blocked another 12,632 attempts in the preceding 24 hours, showing that the campaign continued after the initial surge.

Wordfence observed that two of the largest attack sources polled small groups of sites for roughly 14.5 hours, apparently waiting for an upgrade to begin. Other sources cycled through many variations of staging directory names and version strings, attempting to guess the exact layout WordPress uses.

Not every request hit the precise vulnerable path, yet the probes' persistence and precision revealed a clear understanding of the underlying weakness. Alex Thomas, who leads the Wordfence Threat Response Team, concluded that the sustained probing showed "attackers quickly understood the race condition and began targeting it."

Independent Sensors and CISA Confirm the Threat

Threat intelligence firm Previdian also detected activity, recording three exploitation attempts against its honeypot sensors from a single IP address in the United Kingdom. All three attempts occurred on October 30, 2026, and Previdian has recorded no further activity against its sensors through November 5. Previdian stresses that sensor hits show only attempted attacks and do not prove that a target was vulnerable or that the attack succeeded. The firm rates the exploitation evidence as confirmed, although the EPSS model still assigns the flaw only a 1.0% chance of exploitation within 30 days.

The flaw initially lacked a CVE identifier, and the CVE Numbering Authority reserved CVE-2026-119977 on October 30 before publishing the record on October 31. CISA then added the vulnerability to the KEV catalog on November 3, roughly six days after WordPress shipped the patch. Security vendors and national agencies, including Qualys and the Dutch National Cyber Security Centre, published their own advisories on November 4. The binding deadline applies only to US federal agencies, but CISA routinely urges private organizations to treat KEV entries as top patching priorities.

WordPress powers a large share of the web, so a Core flaw spanning releases dating back to version 4.7 exposes a vast number of sites. The attack turns a routine maintenance task into a risk, because the very act of updating WordPress briefly opens the door to attackers. A successful attacker gains code execution on the server, which can lead to rogue administrator accounts, malicious plugins, or planted PHP files. Attackers can then use a compromised site to host malware, redirect visitors to scam pages, steal data, or launch attacks against other systems.

The high attack complexity rating reflects the narrow timing window; however, automated polling allows attackers to compensate by trying again and again at scale. A bot that checks a staging path repeatedly for many hours needs only one well-timed hit to compromise a vulnerable site. This mix of zero required privileges and tireless automation makes the flaw a serious threat despite its demanding timing requirements.

Wordfence and CISA urge all WordPress administrators to update to version 7.1.4 or the corresponding security release for their branch without delay. Administrators should confirm the installed version in the dashboard rather than assume that automatic updates have already applied the fix. Site owners should also review their servers for signs of compromise, and Wordfence recommends that they check the following areas:

• Web server logs for suspicious requests to PHP files under wp-content/upgrade
• The user list for unfamiliar administrator accounts
• The plugins directory for add-ons that nobody on the team installed
• The file system for unfamiliar PHP files

Hosting providers and server administrators can further reduce risk by blocking public PHP execution within the wp-content/upgrade directory at the web server level. A web application firewall with up-to-date rules can also block requests to staged installer paths before they ever reach a vulnerable WordPress installation.

Organizations that manage many sites should inventory every WordPress installation, because forgotten test or staging sites often run outdated versions for years. Any site that shows signs of compromise needs a full cleanup, including password resets, file restoration from a clean backup, and a malware scan.

Patching closes the hole but doesn't show whether attackers got in first. The free PCrisk Website Scanner gives a quick outside check: over 90 antivirus engines and threat databases, plus a look at the page code for injected scripts and scam redirects. For daily monitoring, the PCrisk Trust Badge WordPress plugin rescans the site and hides its badge if a problem is detected.

The CVE-2026-119977 campaign shows how quickly attackers now weaponize newly disclosed flaws, even those that demand precise timing to exploit. Wordfence detected probing within hours of the patch, while CISA confirmed exploitation less than a week after the WordPress team released the fix. Site owners who apply updates promptly and monitor their servers for unusual files stand the best chance of avoiding a costly compromise.