CISA Flags WordPress Core TOCTOU Flaw as Actively Exploited
November 4: BleepingComputer reports Wordfence blocked 13,095 attacks in 24 hours and references BOD 26-04. The Hacker News adds CVSS 8.1 and 12,632 blocked attempts.
CISA added CVE-2026-119977 to its KEV catalog on November 3, 2026, confirming active exploitation of a TOCTOU race condition in WordPress Core upgrades that enables unauthenticated remote code execution.
CISA added CVE-2026-119977, a time-of-check time-of-use race condition in WordPress Core, to its Known Exploited Vulnerabilities catalog on November 3, 2026. The flaw affects versions 4.7 through 7.1.3 and allows unauthenticated attackers to execute arbitrary code on servers during full-package upgrades via predictable staging paths. WordPress released version 7.1.4 on October 28, 2026 to address the vulnerability. Federal agencies must apply mitigations by November 6, 2026. Wordfence observed over 18,500 exploitation attempts in the first 21 hours after disclosure.
- CVE-2026-119977 added to CISA KEV catalog on November 3, 2026
- Affects WordPress Core 4.7-7.1.3; fixed in 7.1.4 (released October 28, 2026)
- TOCTOU race condition enables unauthenticated code execution during upgrades
- CVSS score 8.1; federal agencies must patch by November 6, 2026
- Wordfence recorded over 18,500 exploitation attempts in first 21 hours
Timeline
dated events in the reporting · oldest first- Oct 28, 2026WordPress releases 7.1.4 fixing the vulnerability · WordPress
- Oct 30, 2026Exploitation recorded in UK honeypot · The Hacker News
- Nov 3, 2026CISA adds CVE-2026-119977 to KEV catalog · CISA
- Nov 6, 2026Federal agencies must apply mitigations · CISA
- Nov 4, 2026Reports detail Wordfence observations of exploitation attempts · Multiple outlets
What each outlet adds
beyond the shared facts- BleepingComputerReports Wordfence blocked 13,095 attacks in 24 hours and references BOD 26-04
- The Hacker NewsCVSS score 8.1; 12,632 attacks blocked in last 24 hours; exploitation recorded October 30
- WordfenceObserved over 18,500 exploitation attempts in first 21 hours after disclosure
- QualysQID 735969 detects vulnerable assets; mitigation versions up to 7.1.4
- GBHackersBackports available for older branches
- CVEs
- CVE-2026-119977
- Products
- WordPress Core
- Countries
- US
Coverage
oldest first · one row per article · UTC- · 1d ago
CISA Known Exploited VulnerabilitiesFirst report
CISA KEV: WordPress Core TOCTOU race condition CVE-2026-119977
WordPress Core upgrade TOCTOU vulnerability enables unauthenticated code execution during staging.
- · 8h ago
The Hacker News
CISA adds WordPress Core TOCTOU flaw to KEV
CISA confirms active exploitation of CVE-2026-119977 allowing unauthenticated code execution during upgrades.
- · 4h ago
Security Affairs
CISA adds WordPress flaw to KEV catalog
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog; Wordfence recorded over 18,500 exploitation attempts in 21 hours.
- · 4h ago
Cyber Security News
CISA Adds WordPress Upgrade Flaw to KEV Catalog
CVE-2026-119977 allows remote code execution via race condition during WordPress upgrades.
- · 2h ago
Qualys ThreatPROTECT
CISA Adds WordPress Core Vulnerability to KEV Catalog
CVE-2026-119977 TOCTOU race condition enables unauthenticated remote code execution during upgrades.
- · 2h ago
GBHackers
CISA adds WordPress code execution vulnerability to KEV catalog
CVE-2026-119977 allows unauthenticated code execution during WordPress upgrades and is actively exploited.
- · 1h ago
BleepingComputer
CISA flags WordPress RCE flaw as actively exploited in attacks
CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |