News · eGov
The U.S. cyber-security agency has listed a high-severity WordPress Core vulnerability in its Known Exploited Vulnerabilities catalogue after evidence emerged of widespread active exploitation during software upgrade windows.
✦ AI SUMMARY 30-second read
- CVE-2026-119977 is a TOCTOU race condition flaw scoring 8.1 on the CVSS scale, allowing unauthenticated attackers to execute code on a server during a Core upgrade.
- More than 18,500 requests targeting staged installer paths were recorded in the first 21 hours after public disclosure, with 12,632 attacks blocked in a single 24-hour period.
- Federal Civilian Executive Branch agencies in the United States have until 6 November 2026 to apply the available patches.
Why it matters: Unauthenticated code execution on widely deployed WordPress servers poses a direct risk to government and enterprise web infrastructure globally.
This summary was generated by AI. Editors may review and update it.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to its Known Exploited Vulnerabilities (KEV) catalogue, confirming that the vulnerability is being actively targeted by threat actors.
The flaw, tracked as CVE-2026-119977 and assigned a CVSS score of 8.1, is classified as a Time-of-check Time-of-use (TOCTOU) race condition. It can allow an unauthenticated attacker to execute arbitrary code on an affected server during the window in which a full-package Core upgrade is being applied.
Patches for the vulnerability were released late last month, and Federal Civilian Executive Branch (FCEB) agencies have been given until 6 November 2026 to apply them.
What was announced
CISA stated that the vulnerability arises from predictable, web-accessible staging paths used during full-package Core upgrades. Because the installer path is reachable from the web during this brief window, an attacker does not need any account credentials on the targeted site to attempt exploitation.
The agency's addition of CVE-2026-119977 to the KEV catalogue signals that exploitation is no longer theoretical and that remediation is treated as a priority for federal agencies.
Scale of exploitation attempts
WordPress security company Wordfence disclosed details of the flaw last week, noting that exploitation requires timing an attack to coincide with a complete Core update. Despite that constraint, the volume of attempts has been substantial.
In the first 21 hours after public disclosure, Wordfence recorded more than 18,500 requests directed at staged setup-config.php installer paths. In the most recent 24-hour period reported, the company said it had blocked 12,632 attacks attempting to exploit the vulnerability.
Separately, telemetry from Previdian recorded three exploitation attempts against its honeypot sensors, originating from an IP address geolocated in the United Kingdom. Those events were observed on 30 October 2026.
What it means for India and global operators
WordPress powers a large share of websites globally, including those operated by government departments, educational institutions, healthcare providers and financial organisations. A vulnerability that permits unauthenticated code execution, even within a limited time window, carries significant risk for any organisation that runs automatic or scheduled Core updates.
Site administrators are advised to apply the patches released last month without delay. Organisations that cannot patch immediately may consider disabling automatic Core upgrades temporarily and monitoring web-accessible staging paths as a mitigating step, consistent with general security practice for TOCTOU-class vulnerabilities.
What happens next
With CISA's formal confirmation of active exploitation, pressure on both federal and commercial operators to patch quickly is expected to intensify. The 6 November 2026 deadline applies specifically to FCEB agencies in the United States, though the guidance serves as a broader signal to all operators of WordPress-based infrastructure.
Elets will continue to update this story as further information becomes available.