As reported by BleepingComputer, CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) Catalog following confirmed active exploitation of a WordPress Core remote code execution flaw. The vulnerability, patched in WordPress 7.1.4 on October 28, stems from a Time-of-check Time-of-use (TOCTOU) race condition in the WordPress upgrade process — and defenders across both public and private sectors should treat this as a priority-one remediation event.
Vulnerability Details
| Field | Details |
|---|---|
| CVE ID | CVE-2026-119977 |
| Severity | High |
| Root Cause | TOCTOU race condition in WordPress upgrade process via predictable, web-accessible staging paths |
| Affected Product | WordPress Core versions prior to 7.1.4 |
| Patched Version | WordPress 7.1.4 (released October 28, 2026) |
| Active Exploitation | Yes — confirmed by CISA; Wordfence reports 13,09+ blocked attempts in 24 hours |
| Researcher | Umut Bayram, Picus Security |
Why This Matters
WordPress powers roughly 40% of all websites on the internet, making any Core-level RCE vulnerability a significant systemic risk. While the TOCTOU race condition requires high complexity to exploit — attackers must win a timing window during the upgrade process — the predictable, web-accessible staging paths lower the barrier enough for determined threat actors to automate attempts at scale. Wordfence's report of over 13,000 attack attempts in a single 24-hour window suggests this is already being weaponized in mass scanning campaigns.
The exploit window exists specifically during full-package core upgrades, when WordPress temporarily places upgrade files in predictable locations. An attacker who can predict the staging path and win the race can inject malicious code that gets executed with web server privileges. This is not a nuanced, surgical exploit — it's a broad-spray opportunity that automated botnets can hammer across thousands of sites simultaneously.
Context: WordPress Core as a Target
This isn't an isolated incident. Earlier in 2026, the wp2shell vulnerability chain (CVE-2026-63030 and CVE-2026-60137) demonstrated how Core-level flaws can be chained for full server takeover. That chain was publicly exploited within days of disclosure, and by September, a Chinese-speaking threat actor had leveraged it to exfiltrate over 18,500 records from small businesses and government organizations. The pattern is clear: WordPress Core vulnerabilities are rapidly operationalized by both criminal and state-sponsored actors.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Patch now: Upgrade all WordPress instances to version 7.1.4 or later. This is non-negotiable given active exploitation.
- Verify auto-update configuration: Ensure WordPress Core auto-updates are enabled. For mission-critical sites, consider a staged update pipeline with immediate alerting.
- Restrict access to staging paths: If you cannot immediately patch, use web server configuration (e.g.,
.htaccess, nginx rules) to block direct access to/wp-admin/includes/and upgrade staging directories from non-trusted IPs. - Enable WAF rules: If using a WAF or CDN (Cloudflare, Sucuri, Wordfence), ensure rules for CVE-2026-119977 are active. Wordfence has already deployed virtual patches.
- Audit for compromise: Given the volume of attack attempts, check your WordPress installations for signs of post-exploitation: unexpected files in
wp-content, new or modified plugins, suspicious scheduled tasks, and unauthorized admin accounts. - Review file integrity: Compare current WordPress Core file checksums against the official release. Any discrepancies may indicate prior exploitation.
Strategic Recommendations
- Inventory WordPress assets: You cannot defend what you don't know exists. Maintain a current inventory of all WordPress instances, versions, and hosting providers across your organization — including shadow IT sites on marketing or departmental budgets.
- Subscribe to WordPress security notifications: Ensure your security team receives the WordPress security release advisories in real time, not days later.
- Plan for rapid Core patching: Establish a tested runbook for WordPress Core security releases that can be executed within hours, not days, of a KEV-level advisory.
The speed at which WordPress Core vulnerabilities move from patch to mass exploitation has shortened dramatically. Organizations that treat WordPress as a low-priority CMS rather than critical infrastructure are learning — often the hard way — that threat actors do not make the same mistake.
CISA's KEV addition and the BOD 26-04 deadline (Friday for FCEB agencies) should signal to all defenders that the window between disclosure and exploitation is measured in hours, not weeks. If you're running WordPress and haven't patched to 7.1.4, you are already in the crosshairs.
