The US Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are exploiting a recently patched high-severity WordPress Core vulnerability in the wild, adding the flaw to its Known Exploited Vulnerabilities catalog and ordering federal agencies to secure their systems by Friday.
The vulnerability, tracked as CVE-2026-119977, is a high-severity WordPress Core flaw stemming from a time-of-check time-of-use (TOCTOU) race condition reported by Picus Security researcher Umut Bayram. Successful exploitation can let remote attackers without privileges execute code on the server in high-complexity attacks, due to predictable, web-accessible staging paths used during full-package core upgrades.
The WordPress security team patched the issue on October 28 with the release of WordPress 7.1.4, describing it as "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window." "Because this is a security release, it is recommended that you update your sites immediately," the team said.
CISA confirmed the exploitation on Tuesday; the order applied to Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the agency warned. Although the directive applies only to US federal agencies, CISA urged all network defenders, including those in the private sector, to prioritize patching.
The agency did not provide further details on the attackers. WordPress security firm Wordfence said in an advisory update over the weekend that it "blocked 13,095 attacks targeting this vulnerability in the past 24 hours."
In July, the WordPress security team patched a critical chain named wp2shell, involving a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137). Public wp2shell exploits were released one day after the patches went live, and in September a Chinese-speaking threat actor weaponized the chain to steal data from more than 18,500 records in backend databases belonging to small businesses and government organizations.
Analysis
Why This Matters
- The flaw sits in WordPress Core, which powers a large share of the web, and remote code execution can lead to server takeover, webshell deployment and data theft on unpatched sites.
- CISA's KEV listing triggers a binding Friday deadline for US federal agencies, but the agency's call to private-sector defenders signals risk well beyond government networks.
- The earlier wp2shell chain shows how quickly public exploits escalate into breaches, with attacks beginning within days of patches being released.
Background
WordPress is an open-source content management system used by a significant share of websites worldwide. CISA is the US federal agency responsible for cybersecurity, and its Known Exploited Vulnerabilities catalog tracks flaws confirmed to be under attack; Binding Operational Directive 26-04 sets remediation deadlines for federal civilian agencies.
What to Watch
- Whether federal agencies meet the Friday deadline set by CISA under Binding Operational Directive 26-04.
- Whether CISA releases more detail on the attackers now exploiting CVE-2026-119977.
- Whether the volume of attacks reported by Wordfence continues to rise and other security vendors report similar activity.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedCISA warned that attackers are actively exploiting the WordPress flaw.BleepingComputer: “CISA warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild.”
- SupportedCISA added CVE-2026-119977 to its KEV catalog.BleepingComputer: “CISA confirmed CVE-2026-119977 active exploitation on Tuesday and added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog”
- SupportedFederal Civilian Executive Branch agencies were ordered to secure their systems by Friday.BleepingComputer: “ordering Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Friday, as mandated by Binding Operational Directive (BOD) 26-04.”
- Partly supportedThe WordPress security team described the flaw as “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window.”BleepingComputer: ““A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window,” the WordPress security team said”
- SupportedThe WordPress security team said, “Because this is a security release, it is recommended that you update your sites immediately.”BleepingComputer: ““Because this is a security release, it is recommended that you update your sites immediately.””
- SupportedCISA warned, “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.”BleepingComputer: ““This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency warned.”
- SupportedWordfence said it “blocked 13,095 attacks targeting this vulnerability in the past 24 hours.”BleepingComputer: “Wordfence says in an advisory update over the weekend that it “blocked 13,095 attacks targeting this vulnerability in the past 24 hours.””
- SupportedThe flaw is a TOCTOU race condition reported by Picus Security researcher Umut Bayram.BleepingComputer: “this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram.”
- SupportedSuccessful exploitation can let remote attackers without privileges execute code on the server in high-complexity attacks.BleepingComputer: “Successful exploitation can let remote threat actors without privileges execute code on the server in high-complexity attacks”
- SupportedWordPress released version 7.1.4 with patches for the issue on October 28.BleepingComputer: “the WordPress security team said on October 28 when it released WordPress 7.1.4 with patches to address this security issue.”
- SupportedCISA did not provide further details on the attackers exploiting the flaw.BleepingComputer: “While CISA didn't provide more details on attackers exploiting CVE-2026-119977 in the wild”
- SupportedIn September, a Chinese-speaking threat actor used the wp2shell chain to steal data from more than 18,500 records in backend databases belonging to small businesses and government organizations.BleepingComputer: “A Chinese-speaking threat actor also weaponized the wp2shell exploit chain in September to steal sensitive data from more than 18,500 records stored in backend databases belonging to small businesses and government organizations.”
