CISA Flags Active Exploitation of WordPress Core Upgrade Flaw CVE-2026-119977
Site operators running WordPress core upgrades face an unauthenticated code-execution risk until patches are applied.
CISA has added a high-severity WordPress Core flaw, CVE-2026-119977 (CVSS 8.1), to its Known Exploited Vulnerabilities catalog after confirming active attacks. The bug is a time-of-check time-of-use race condition that can let an unauthenticated attacker run code on a server during a full-package core upgrade, because the staging paths used in that process are predictable and reachable over the web. Wordfence reported more than 18,500 requests aimed at staged setup-config.php installer paths in the first 21 hours after disclosure, and said 12,632 attacks had been blocked in the last 24 hours as of its writing. Previdian recorded three exploitation attempts against its honeypots from a U.K.-geolocated IP address on October 30, 2026. Patches were released late last month, and Federal Civilian Executive Branch agencies have until November 6, 2026 to apply them.
Why it matters
The flaw sits in the window where WordPress replaces its own core files, and the staging paths used then are predictable and reachable from the web, so any site that is mid-upgrade or has not yet patched is exposed to attackers who are already probing for it. Attack volume reported by Wordfence and a separate honeypot observation show the attempts are real and ongoing rather than theoretical. For the wider WordPress ecosystem, the practical takeaway is that the upgrade process itself, not only the plugins or themes running on a site, has become an attack surface that needs prompt patching.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.