CISA Adds Actively Exploited WordPress Core Upgrade Flaw to KEV

CISA confirms exploitation of a WordPress Core vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-119977, a high-severity WordPress Core vulnerability with a CVSS score of 8.1, to its Known Exploited Vulnerabilities catalog. CISA cited evidence that attackers are actively exploiting the flaw, for which patches were released late last month.

The issue is a time-of-check time-of-use, or TOCTOU, race condition. It can allow an unauthenticated attacker to execute code on an affected server during the short window created by a complete WordPress Core upgrade.

CISA said the exposure arises from predictable, web-accessible staging paths used in full-package core upgrades. Exploitation therefore does not require an account on the targeted site, but it depends on the attacker reaching the relevant path while that brief upgrade condition exists.

High volumes of attempts followed public disclosure

Wordfence published technical details of the issue last week and reported that exploitation does not require site authentication. In the first 21 hours after public disclosure, the WordPress security company recorded more than 18,500 requests aimed at staged setup-config.php installer paths.

At the time of reporting, Wordfence had blocked 12,632 exploit attempts over the preceding 24 hours. Separate telemetry from Previdian recorded three attempts against its honeypot sensors from an IP address geolocated in the United Kingdom. Those events were observed on October 30, 2026.

Required action for affected organizations

CISA’s KEV listing formalizes the immediate remediation priority for organizations operating WordPress sites. Federal Civilian Executive Branch agencies have until November 6, 2026, to apply the available fixes.

For other operators, the confirmed exploitation and the observed request volume make patching WordPress Core the central action. Teams should also review web-server and security telemetry for requests to staged installer paths, particularly around full-package core upgrades, and ensure upgrade procedures use the vendor-provided remediated release.

The business implication is straightforward: organizations that run WordPress should schedule the fix without delay and treat every core-upgrade window as an operational security event requiring monitoring.