CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.

This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window.

CISA added this vulnerability to the catalog on November 3, 2026, and set a remediation deadline of November 6 for affected federal civilian agencies. The vulnerability has a CVSS v3.1 score of 8.1, indicating a high potential impact, although exploitation requires precise timing.

WordPress Core Code Execution Vulnerability

According to the published CVE record, the vulnerability affects WordPress branches dating from 4.7 through 7.1.3. It stems from predictable, web-accessible staging paths created during full-package Core upgrades, rather than a vulnerable third-party plugin or theme.

During affected updates, WordPress extracts installation files into temporary directories under wp-content/upgrade. If those directories permit public access and PHP execution, an attacker can reach the staged setup-config.php installer before cleanup completes. This exposure can enable PHP code execution without valid WordPress credentials.

The issue is classified as a time-of-check, time-of-use race condition, or CWE-367. Its defining characteristic is that a resource’s state can change between validation and use, undermining assumptions about safe processing. Here, the exploitable opportunity exists during the upgrade lifecycle.

Earlier WordPress exploitation reporting documented 58,693 blocked attack attempts within 24 hours. Those detections represent attempted exploitation, not an equivalent number of successfully compromised websites.

WordPress addressed the upgrade weakness in version 7.1.4, released October 28. Researcher Umut Bayram received credit for reporting it. The vendor recommended immediate updates and announced security backports for eligible branches through WordPress 4.7, noting that backports would ship as ready.

The security release analysis describes protections including randomized staging directories, an index guard, and restrictions on unsafe promotion of staged configuration data. Administrators should verify the installed release rather than assume an automatic update completed successfully.

The supplied CISA entry also requires forensic triage under BOD 26-04 and lists ransomware involvement as unknown. Operators should follow vendor mitigation instructions and investigate suspicious activity around recent upgrades.

Unlike previously reported WordPress SQL injection attacks, this vulnerability specifically targets temporary upgrade infrastructure, making update-path exposure central to remediation and incident review.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.