CISA confirms active exploitation of WordPress upgrade flaw
CISA confirmed on Tuesday that attackers are exploiting CVE-2026-119977, a high-severity WordPress Core vulnerability, and added it to the Known Exploited Vulnerabilities catalog. The flaw affects the WordPress upgrade process and can enable remote code execution on a server during a core upgrade, according to CISA and the WordPress security team.
The vulnerability is a time-of-check to time-of-use race condition. During a full-package upgrade, predictable staging paths exposed through the web can allow remote attackers without privileges to execute code, although the attack is classified as high complexity, according to the report.
The WordPress security team released WordPress 7.1.4 on October 28 with a patch for the issue and advised site operators to update immediately. The team described the weakness as one that can lead to remote code execution during the upgrade window.
CISA ordered US Federal Civilian Executive Branch agencies to secure affected systems by Friday under Binding Operational Directive 26-04. The directive does not apply to private-sector organizations, but CISA urged private-sector defenders to prioritize the patch as well.
The available evidence does not identify the attackers or describe how they are exploiting the flaw. Wordfence reported blocking 13,095 attacks targeting CVE-2026-119977 in a 24-hour period, but CISA provided no further details about those attacks.