CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a critical security flaw in the WordPress Core software, adding it to their Known Exploited Vulnerabilities (KEV) catalog. This high-severity vulnerability, identified as CVE-2026-119977 with a CVSS score of 8.1, is a Time-of-check Time-of-use (TOCTOU) race condition. Such flaws allow unauthenticated attackers to execute arbitrary code on affected servers during the software upgrade process.

WordPress Core is susceptible to this TOCTOU race condition due to predictable web-accessible staging paths that are accessible during full-package core updates. Initially, it was reported that exploiting this vulnerability does not necessitate an account on the site, but it does require an attacker to exploit a brief window during the complete Core update.

In the first 21 hours following the public disclosure of the flaw, Wordfence's security company recorded over 18,500 requests targeting the staged setup-config.php installer paths. As of the latest data, 12,632 attacks aimed at exploiting this vulnerability have been blocked within the last 24 hours. Additionally, telemetry data from Previdian indicates that three exploitation attempts have been recorded against its honeypot censors from an IP address located in the U.K., taking place on October 30, 2026.

With the confirmation of this exploitation by CISA, Federal Civilian Executive Branch (FCEB) agencies have until November 6, 2026, to apply the necessary patches.