CISA Confirms Active Exploitation of WordPress Core Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation of a high-severity flaw tracked as CVE-2026-119977 (CVSS 8.1).

CISA describes the vulnerability as a time-of-check time-of-use (TOCTOU) race condition that can be exploited to achieve arbitrary code execution on affected servers, specifically during the upgrade window for full-package core updates, due to predictable, web-accessible staging paths. Patches for the flaw were released late last month, according to CISA.

Wordfence had previously highlighted that exploitation does not require a user account, but attackers must exploit a brief window during a Core update to gain unauthenticated code execution. Early telemetry from Previdian indicates three exploitation attempts observed via its honeypot from an IP address geolocated in the United Kingdom, with the events detected on 30 October 2026.

In practical terms, CISA notes that the vulnerability is now formally confirmed as exploited, and Federal Civilian Executive Branch (FCEB) agencies have until 6 November 2026 to apply the fixes. Since the disclosure, researchers reported a surge of attempted and blocked attacks targeting the staged "setup-config.php" installer paths, with thousands of requests observed in the initial hours following disclosure.