CISA has confirmed that a WordPress Core RCE flaw, tracked as CVE-2026-119977, is being exploited during full-package upgrades. The agency added the high-severity Time-of-check Time-of-use bug to its Known Exploited Vulnerabilities catalog on November 3, 2026, and ordered federal civilian agencies to remediate by November 6, 2026. No WordPress account is required; attackers need a predictable, web-accessible staging path while Core is updating.
Key Takeaways
- CISA added CVE-2026-119977 to the KEV catalog after confirming exploitation.
- Unauthenticated code execution is possible during full-package WordPress upgrades.
- Federal civilian agencies must remediate affected systems by November 6, 2026.
- Wordfence recorded more than 18,500 staging-path requests in 21 hours.
How the WordPress Core RCE Works
Picus Security researcher Umut Bayram reported the flaw, according to BleepingComputer. Remote attackers without privileges can execute code in high-complexity attacks because full-package upgrades use predictable staging paths.
Security Affairs says versions 4.7 through 7.1.3 are affected, with a CVSS score of 8.1. WordPress fixed the issue in 7.1.4 on October 28, 2026. PCQuest reports matching fixes for older branches, so a site on 7.1.3 or earlier needs the patched release for its branch.
A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window.
The WordPress security team said that on October 28, BleepingComputer reported, adding, “Because this is a security release, it is recommended that you update your sites immediately.” During an upgrade, WordPress extracts installation files before the job finishes. The Hacker News reported that Wordfence found no account is required, but the attacker must catch the brief window of a complete Core update.
CISA KEV Deadline for Federal Agencies
CISA confirmed active exploitation and added CVE-2026-119977 to the KEV Catalog. Federal Civilian Executive Branch agencies must apply fixes by November 6, 2026. BleepingComputer reports that order as mandated by Binding Operational Directive 26-04. Security Affairs cites BOD 22-01, which requires FCEB agencies to address cataloged vulnerabilities by the assigned due date.
“WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window,” CISA said, as quoted by The Hacker News. The agency tied the bug to “predictable, web-accessible staging paths used during full-package core upgrades,” and warned, “This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.”
CISA urged all network defenders, including private-sector teams, to prioritize patching even though the binding date applies only to federal civilian agencies.
Attack Volume on Predictable Staging Paths
Wordfence telemetry, published via Security Affairs, shows how quickly scanning started:
Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths.
Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window. Other sources tested many staging-directory and version-name variations. Security Affairs notes these figures document exploitation attempts, not confirmed compromises.
| Observation | Figure | Window |
|---|---|---|
| Wordfence staging-path requests | More than 18,500 | First 21 hours |
| Wordfence blocks, weekend advisory | 13,095 | Prior 24 hours |
| Wordfence blocks, Hacker News count | 12,632 | Prior 24 hours |
| Previdian honeypot attempts | 3 | October 30, 2026 |
BleepingComputer tied 13,095 blocks to a weekend Wordfence advisory. The Hacker News reported 12,632 blocks over the prior 24 hours, and three Previdian events on October 30, 2026, from an IP geolocated in the United Kingdom. Analysis: the two daily figures are separate snapshots of attempts, not a count of compromised sites.
What Website Operators Should Do
Check the installed Core version, apply the security release for that branch, and confirm automatic updates completed. Review access logs around recent upgrades and investigate unexpected file changes. Depending on server permissions, successful exploitation could enable unauthorized file changes, malicious content, or exposure of sensitive information, PCQuest reported.
- Inventory every WordPress site, including branches dating back to 4.7.
- Update to 7.1.4 or the patched release that matches the running branch.
- Restrict public access to temporary installation directories.
- Place a web application firewall in front of staged installer paths.
In July, WordPress patched a critical chain named wp2shell, pairing REST API batch-route confusion CVE-2026-63030 with SQL injection CVE-2026-60137. Public exploits appeared one day later. Within days, attackers breached unpatched servers to deploy persistent webshells and install malicious plugins. In September a Chinese-speaking threat actor used that chain to steal sensitive data from more than 18,500 records in backend databases belonging to small businesses and government organizations, BleepingComputer reported.
Teams tracking PHP and WordPress RCE exploitation and other CISA KEV additions should expect scans within minutes of a Core security release. Analysis: authentication logs will miss an unauthenticated staging-path request. Version inventory and controls on the upgrade window are the practical match for this bug.
