CISA Confirms Active Exploitation of WordPress Core During Update Window

CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities catalog on November 3, 2026, confirming active exploitation of a race condition in the WordPress Core update mechanism. The vulnerability turns a supposedly safe operation — upgrading the CMS — into an attack vector, with a binding federal deadline of November 6, 2026, for Federal Civilian Executive Branch agencies. The threat is particularly insidious: the attack requires precise timing conditions, yet Wordfence metrics show over 18,500 requests targeting staging paths in the first day after disclosure alone.

The Hidden Race Condition in the Upgrade Process

The flaw lies in how WordPress Core handles full-package updates. During file extraction, the system creates a temporary directory under wp-content/upgrade with predictable names. This directory remains web-accessible for a measurable interval before the cleanup process removes it. According to the official CVE record, classified under CWE-367, an unauthenticated attacker who intercepts this window can access the setup-config.php file in staging and redirect the database configuration to attacker-controlled infrastructure.

The vector is classic TOCTOU: the file accessibility check and its actual use occur at different times, without adequate synchronization. The high attack complexity — reflected in the CVSS vector's AC:H parameter — has not prevented massive automation: Wordfence detected over 18,500 targeted requests in the first 21 hours after public disclosure, according to The Hacker News. A subsequent data point indicates 12,632 attacks blocked in the last 24 hours of detection.

The Line Between Attempts and Confirmed Exploits

The distinction between mass scanning and successful exploitation is critical. Previdian's honeypot recorded 3 exploitation attempts from a UK IP address on October 30, 2026, two days after the patch release. CISA does not publish the number of confirmed compromises; the KEV catalog indicates exploitation status as active but classifies ransomware campaign presence as "Unknown." This limit is relevant for risk calibration: the density of attempts suggests automated tooling, not necessarily targeted operations with stable access achieved.

A second numerical data point warrants attention. Cybersecuritynews.com reports 60,471 blocked attempts in 24 hours, but the context is broader than this single CVE: the figure aggregates general WordPress RCE activity, not CVE-2026-119977 specifically. For this reason, the data is not interchangeable with Wordfence metrics on staging paths.

"WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades." — CISA, as cited by The Hacker News

The Federal Deadline and Operational Pressure

Inclusion in the KEV catalog triggers Binding Operational Directive 26-04, which mandates remediation by November 6, 2026, for federal civilian agencies. The window is tight: three business days from the CISA announcement. The directive also requires forensic triage to verify any prior compromises, a non-trivial operational burden for environments with WordPress deployments distributed across hundreds of instances.

The unauthenticated nature of the vulnerability removes a standard protection barrier: no stolen credentials or hijacked sessions are needed. The attacker must only align temporally with an ongoing update, a condition that managed hosting platforms and automatic update tools can unwittingly facilitate with predictable scheduling. Attribution to Umut Bayram as the researcher who reported the flaw is documented by Cybersecuritynews.com; the motive and identity of active operators remain undetermined.

Immediate Actions

• Update immediately to WordPress Core 7.1.4, released October 28, 2026, with the specific fix for this race condition
• Check access logs for anomalous requests to paths under wp-content/upgrade during scheduled maintenance windows, with attention to requests to setup-config.php in staging
• Perform forensic triage on systems that performed full-package updates in the weeks prior to November 3, 2026, as required by BOD 26-04 for covered organizations
• Reevaluate the frequency and predictability of automatic update slots: the TOCTOU race condition gains success probability when attackers can accurately predict the vulnerable window interval

The Bigger Problem Beyond Routine Maintenance

This vulnerability reveals a fragile assumption in CMS management: that maintenance operations are inherently safer than ordinary user interactions. The TOCTOU race condition proves the opposite. The upgrade window is a transition moment where standard access controls can be bypassed by insufficiently protected temporary paths.

The CVSS 8.1 severity reflects high impacts on confidentiality, integrity, and availability, not ease of exploitation. The AC:H parameter indicates the attack requires temporal precision, but distributed automation lowers this hurdle. The 18,500 requests in 21 hours demonstrate that threat operators have integrated the vector into their playbooks.

For organizations managing WordPress, the lesson is operational: upgrade security depends as much on the speed of patch application as on reducing the attack surface during the vulnerable window. Predictable staging directories, known maintenance intervals, absence of rate limiting on temporary paths: these factors amplify a technically complex vulnerability into a concrete management risk.

Sources

• thehackernews.com
• cybersecuritynews.com
• cve.org
• cisa.gov
• cisa.gov