CISA flags WordPress RCE flaw as actively exploited in attacks
CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.
CISA warned that attackers are exploiting a recently patched WordPress vulnerability tracked as CVE-2026-119977. The flaw is a Time-of-check Time-of-use race condition in the upgrade process allowing remote code execution. Successful attacks can occur during full-package core upgrades using predictable staging paths. CISA ordered federal agencies to patch by the deadline in BOD 26-04. Wordfence blocked over 13,000 attacks in the past day.
- CVE-2026-119977 added to CISA KEV catalog
- High-severity flaw in WordPress 7.1.4
- Exploited in the wild
- Affects core upgrade process
- Wordfence blocked 13,095 attacks in 24 hours
Impact: remote code execution during upgrade
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | before 7.1.4 | 7.1.4 |
- 1.Update to WordPress 7.1.4
- 2.Apply immediate patches to all sites
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.