{
  "id": 18085627,
  "title": "CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades",
  "url": "https://urgent.news/2026/11/04/cisa-confirms-hackers-exploiting-wordpress-core-flaw-during-software",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-04T05:43:11.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html"
  },
  "original_language": "en",
  "account": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a critical security flaw in the WordPress Core software, adding it to their Known Exploited Vulnerabilities (KEV) catalog. This high-severity vulnerability, identified as CVE-2026-119977 with a CVSS score of 8.1, is a Time-of-check Time-of-use (TOCTOU) race condition. Such flaws allow unauthenticated attackers to execute arbitrary code on affected servers during the software upgrade process.\n\nWordPress Core is susceptible to this TOCTOU race condition due to predictable web-accessible staging paths that are accessible during full-package core updates. Initially, it was reported that exploiting this vulnerability does not necessitate an account on the site, but it does require an attacker to exploit a brief window during the complete Core update.\n\nIn the first 21 hours following the public disclosure of the flaw, Wordfence's security company recorded over 18,500 requests targeting the staged setup-config.php installer paths. As of the latest data, 12,632 attacks aimed at exploiting this vulnerability have been blocked within the last 24 hours. Additionally, telemetry data from Previdian indicates that three exploitation attempts have been recorded against its honeypot censors from an IP address located in the U.K., taking place on October 30, 2026.\n\nWith the confirmation of this exploitation by CISA, Federal Civilian Executive Branch (FCEB) agencies have until November 6, 2026, to apply the necessary patches.",
  "summary": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}