CISA Flags Exploited WordPress Flaw Allowing Unauthenticated Code Execution

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalogue on 3 November 2026. The vulnerability affects WordPress Core and is a time-of-check time-of-use (TOCTOU) race condition that could let unauthenticated attackers execute code on a server during a core upgrade.

The flaw involves predictable, web-accessible staging paths used during full-package upgrades. An attacker could exploit the race condition during the upgrade window to achieve server-side code execution without authentication. The vulnerability has a CVSS score of 8.1, rated HIGH. A patch is available; WordPress has published an update, and the patch is referenced in the project’s update-core.php code.

CISA’s KEV listing confirms that the vulnerability has been exploited in the wild. Use in ransomware campaigns is unknown. CISA set 6 November 2026 as the remediation deadline.

CISA requires organisations to “apply mitigations in accordance with vendor instructions”, following applicable guidance in Binding Operational Directive 26-04 and CISA’s Forensics Triage Requirements. Where mitigations are unavailable, organisations must follow the applicable BOD 26-04 guidance for cloud services or discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly subject to CISA’s direction.

All organisations should assess their WordPress exposure, including internet-facing assets, and prioritise remediation in line with the relevant guidance.

For full details, consult the NVD entry at https://nvd.nist[.]gov/vuln/detail/CVE-2026-119977 and CISA’s KEV catalogue at https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog.