CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

CVE-2026-119977 is a high-severity vulnerability in WordPress Core. It is a time-of-check time-of-use, or TOCTOU, race condition. The flaw can let attackers execute code on affected servers during a WordPress Core upgrade. Its CVSS score is 8.1, and patches were released late last month.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog because there is evidence that attackers are using it. The flaw involves predictable, web-accessible staging paths created during full-package core upgrades. Attackers do not need an account, but they must act during the short upgrade window.

The listing makes the threat more urgent for organizations that use WordPress. CISA specifically gave Federal Civilian Executive Branch agencies until November 6, 2026, to apply fixes. The deadline reflects confirmed exploitation, not merely a theoretical security concern.

A time-of-check to time-of-use race condition happens when software checks a file, path, or other resource and later uses it. The danger is that the resource can change between those two moments. The software then acts on assumptions that are no longer true.

For WordPress, the vulnerable timing gap appears during a complete Core update. The update process uses temporary staging paths before finishing the installation. The article says those paths are predictable and reachable through the web. An attacker can try to interact with them while the upgrade is underway.

The attack therefore depends on timing, not just access. The attacker must send the right request during the brief period between the update's checks and its later use of the staged files. If successful, that race can lead to arbitrary code execution on the server. The article reports that unauthenticated attackers can attempt it.

A full-package WordPress Core upgrade temporarily prepares files before the update completes. During that process, WordPress creates staging paths that support the installation. The article says these paths are predictable and web-accessible. That combination creates the condition an attacker needs to reach the update process.

An attacker cannot use the same opportunity at any random time. The staged files exist, and the relevant checks and uses occur, only during the upgrade window. The attacker must send requests while that process is active. The vulnerability is therefore a race against the updater's timing.

Wordfence described the flaw as exploitable without an account, but still requiring precise timing. This limits the opportunity's duration, yet it does not eliminate the danger. More than 18,500 requests targeted staged setup-config.php installer paths during the first 21 hours after disclosure, showing that attackers were actively seeking the window.

The earliest reported activity was substantial. During the first 21 hours after the vulnerability became public, Wordfence recorded more than 18,500 requests aimed at staged setup-config.php installer paths. Those requests indicate that attackers were searching for or targeting the temporary paths involved in the flaw.

More recent blocking data shows continued activity. At the time of the report, 12,632 attacks attempting to exploit the vulnerability had been blocked during the previous 24 hours. These figures measure requests or blocked attacks, so they do not all represent successful compromises.

Previdian's telemetry provides the article's confirmed exploitation observations. Its honeypot censors recorded three exploitation attempts from an IP address geolocated in the United Kingdom. Those events occurred on October 30, 2026. CISA subsequently officially confirmed exploitation and added the flaw to its KEV catalog.

The main consequence is arbitrary code execution on an affected server. In practical terms, the attacker can cause the server to run code chosen by the attacker. The article describes this as unauthenticated code execution, so the attacker does not need a WordPress account first.

The opportunity arises during a complete WordPress Core upgrade. WordPress uses predictable, web-accessible staging paths while preparing the update. An attacker can target those paths during the brief upgrade window and exploit the TOCTOU race condition. The race involves the update process checking and later using staged resources.

The article does not detail what attackers did after gaining code execution. It does establish that the impact is serious: the vulnerability has a CVSS score of 8.1, patches were released, and CISA added it to the KEV catalog after evidence of active exploitation. Operators should therefore treat successful exploitation as a server-level security event.

Site operators should apply the released WordPress Core fixes as soon as possible. The article identifies patching as the required response for affected organizations, and CISA has confirmed active exploitation. Federal Civilian Executive Branch agencies have a November 6, 2026, deadline, underscoring the urgency.

Operators should also pay attention to complete Core upgrades and review security monitoring for requests targeting staged setup-config.php paths. The article reports more than 18,500 such requests after disclosure and 12,632 blocked attacks in one recent 24-hour period. These observations can help defenders recognize targeting, although the article does not prescribe a specific monitoring procedure.

Installing the patch matters because the vulnerability can allow unauthenticated arbitrary code execution. It closes the flaw that attackers exploit during the upgrade window. Until patched, a site may remain exposed whenever a complete Core update creates the predictable, web-accessible staging paths described by CISA.

WordPress Core updates can use temporary staging files and paths while a full-package upgrade is being prepared. The article does not describe every update step, but it identifies these staged locations as central to the vulnerability. They exist during the upgrade window before the process completes.

The security problem is that the staging paths are predictable and accessible through the web. An attacker can therefore guess or target a path instead of needing an authenticated account. By acting while WordPress checks and later uses the staged material, the attacker may exploit the TOCTOU race condition. The result can be arbitrary code execution on the server.

This risk is especially important because the window is brief but reachable. Wordfence recorded more than 18,500 requests aimed at staged setup-config.php installer paths during the first 21 hours after disclosure. CISA confirmed active exploitation and advised remediation through its KEV listing. The released patch is intended to address the vulnerable update behavior.