The U.S. Cybersecurity and Infrastructure Security Agency has ordered federal agencies to secure their web servers against an actively exploited vulnerability in WordPress Core. Tracked as CVE-2026-119977, the high-severity flaw enables remote attackers to execute arbitrary code without prior authentication.
The agency updated its Known Exploited Vulnerabilities Catalog on Tuesday after confirming that threat actors are targeting the weakness in the wild. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to remediate the vulnerability by Friday. CISA also urged private organizations to prioritize patching, warning that the security defect presents substantial risks to enterprise networks.
TOCTOU Race Condition During Upgrade Window
Discovered and reported by Picus Security researcher Umut Bayram, CVE-2026-119977 stems from a Time-of-check Time-of-use race condition in the platform's core architecture. The issue exposes predictable, web-accessible staging paths used by the content management system when processing full-package core upgrades.
Although exploiting the race condition involves a high degree of complexity, an unprivileged remote attacker who successfully times the attack can execute arbitrary code on the underlying host. The WordPress security team characterized the bug as a weakness in the update process that permits code execution specifically while the upgrade window remains open.
Spike in Active Attack Telemetry
While federal authorities did not disclose specifics regarding the threat actors weaponizing the flaw, telemetry from third-party defenders shows rapid adversary adoption. WordPress security provider Wordfence reported blocking 13,095 exploitation attempts targeting the vulnerability within a 24-hour window, according to reporting by BleepingComputer.
The rapid mobilization of attacks follows a recurring pattern of WordPress Core exploitation observed throughout the year. In July, developers patched the critical "wp2shell" exploit chain, which combined a REST API batch-route confusion flaw (CVE-2026-63030) with an SQL injection vulnerability (CVE-2026-60137) to install persistent webshells and rogue plugins.
Public exploit code for the wp2shell flaw was released within 24 hours of disclosure, leading to widespread breaches days later. A Chinese-speaking threat group subsequently weaponized that chain in September to compromise backend databases and exfiltrate more than 18,500 sensitive records belonging to government bodies and small businesses.
Vendor Response and Affected Versions
The WordPress security team resolved the race condition on October 28 with the rollout of WordPress 7.1.4. The maintainers classified the release as a critical security update and advised system administrators to apply the maintenance package without delay.
Because the vulnerability targets the temporary file structure utilized during the upgrade workflow, unpatched deployments running earlier releases remain susceptible whenever update sequences are executed.
What You Should Do
Administrators responsible for WordPress infrastructure should immediately verify that their installations are running WordPress 7.1.4 or later. Site owners using managed hosting environments should ensure automated background updates completed successfully and did not stall during execution.
Security teams should also inspect web server access logs for anomalous requests directed at predictable staging directories or temporary file paths during recent update windows. Implementing web application firewall rules capable of filtering malicious requests targeting core update mechanisms can provide defense-in-depth while patches are scheduled across enterprise fleets.
