CISA Confirms Hackers WordPress Flaw During Software Upgrades
WordPress has a newly disclosed security flaw that anyone running it should know about.
WordPress has a newly disclosed security flaw that anyone running it should know about.
The affected service is reachable from the network without authentication.
WordPress may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers.
During the first 21 hours after public disclosure, the WordPress security company said it recorded more than 18,500 requests targeting staged installer paths.
Anyone running WordPress is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.
Details of the flaw emerged last week when Wordfence said exploiting the vulnerability does not require an account on the site.
What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.
Being reachable without authentication is what moves this from 'patch eventually' to 'patch now' -- there's no login screen standing between an attacker and the vulnerable code.
That said, it does require an attacker to exploit a brief window during a complete Core update that could allow unauthenticated code execution.
This is tracked as CVE-2026-119977 and rated high severity, which is the identifier to use when checking vendor guidance.
As of writing, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours.
Telemetry data from Previdian shows that three exploitation attempts have been recorded against its honeypot censors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026.
With exploitation now officially confirmed by CISA, Federal Civilian Executive Branch (FCEB) agencies have time until November 6, 2026, to apply the fixes.
Confirm whether WordPress is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
WordPress has a newly disclosed security flaw that all users should be aware of.
The affected service is accessible from the network without authentication.
WordPress may be functioning normally in your environment while also being reachable from a network that an attacker can access.
What changed
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
This high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), involves a Time-of-check Time-of-use (TOCTOU) race condition that could be exploited for arbitrary code execution on affected servers.
Within the first 21 hours of public disclosure, the WordPress security company reported over 18,500 requests targeting staged installer paths.
Who is affected
Anyone running WordPress is at risk, and since this vulnerability is accessible without authentication, exposure does not rely on user actions.
Details of the flaw emerged last week when Wordfence indicated that exploiting the vulnerability does not require an account on the site.
Why it matters
Successful exploitation allows an attacker to execute code with the permissions of the affected process.
The lack of authentication elevates the urgency from 'patch eventually' to 'patch now' -- there is no login screen preventing an attacker from accessing the vulnerable code.
However, it does require an attacker to exploit a brief window during a complete Core update that could permit unauthenticated code execution.
Technical details
This vulnerability is tracked as CVE-2026-119977 and rated high severity, which is the reference for checking vendor guidance.
As of this writing, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours.
Telemetry data from Previdian indicates that three exploitation attempts have been recorded against its honeypot sensors from an IP address geolocated in the U.K., with the exploitation events observed on October 30, 2026.
Response
With exploitation now officially confirmed by CISA, Federal Civilian Executive Branch (FCEB) agencies have until November 6, 2026, to apply the necessary fixes.
What security teams should do
Confirm whether WordPress is present in your asset and software inventory.
No exploitation has been reported yet, but this status can change, so continue to monitor vendor guidance while you remediate.