CISA flags WordPress RCE flaw as actively exploited in attacks

Adding a flaw to CISA’s Known Exploited Vulnerabilities Catalog means the agency has confirmed exploitation in real attacks. It marks CVE-2026-119977 as an urgent risk, not merely a theoretical weakness. The catalog helps federal agencies prioritize vulnerabilities that attackers are already using.

CISA confirmed active exploitation on Tuesday. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies were ordered to secure their systems by Friday. The flaw affects WordPress Core and can enable remote code execution during a core upgrade.

The deadline formally applies to the federal civilian government. CISA also urged private-sector defenders and other network owners to prioritize patching. The WordPress security team released version 7.1.4 on October 28 and recommended immediate updates because it was a security release.

Remote code execution, or RCE, is a security impact in which an attacker causes a computer or server to run code remotely. The code runs on the target system, rather than only on the attacker’s device. That gives the attacker a powerful foothold.

For CVE-2026-119977, the article says remote threat actors without privileges can execute code during a WordPress core upgrade. The attack is high-complexity, but it targets a weakness in the upgrade process and does not require the attacker to authenticate. The vulnerable window involves temporary upgrade files and paths.

RCE is serious because server-side code can affect the website and the system hosting it. Depending on permissions and configuration, attackers could alter site behavior, access data, or establish persistence. The article therefore treats immediate patching as important for federal and private-sector defenders.

A time-of-check time-of-use, or TOCTOU, race condition occurs when software checks something and later uses it, while the situation can change between those two moments. Security decisions made during the check may no longer be valid when the resource is used. Attackers try to win that timing gap.

In this case, the weakness lies in WordPress’s full-package core upgrade process. The article identifies predictable, web-accessible staging paths used during upgrades. An unauthenticated attacker can target that upgrade window and exploit the mismatch between the system’s check and later use, potentially causing the server to execute code.

The attack is described as high-complexity, so timing and conditions matter. Even so, the impact is remote code execution. WordPress released version 7.1.4 with a fix on October 28 and advised site owners to update immediately, closing the vulnerable upgrade behavior.

The clearest published measure is Wordfence’s count of 13,095 blocked attacks targeting CVE-2026-119977 during a single 24-hour period. That figure shows intense scanning or exploitation activity against the flaw, although it does not establish how many servers were successfully compromised.

CISA confirmed that the vulnerability was being actively exploited and added it to the KEV Catalog. However, the agency did not provide more details about the attackers or the number of successful intrusions. Wordfence’s figure comes from its own blocking activity, reported in an advisory update over the weekend.

The observed activity makes the patching advice urgent. WordPress released version 7.1.4 on October 28 with a fix, and CISA urged both government and private-sector defenders to prioritize updates. The article does not give a confirmed total for compromised websites.

Exploiting CVE-2026-119977 can let a remote attacker without privileges execute code on the server. The article describes this as remote code execution during the WordPress upgrade window. That moves the threat beyond a minor website bug and into the system that runs the site.

The key mechanism is a TOCTOU race condition in the full-package core upgrade process. WordPress uses predictable, web-accessible staging paths during the upgrade. An attacker who wins the race can abuse that process and cause code to run remotely, even without an account.

Code execution can put the website and its server at risk because the attacker gains a way to make the host perform actions. The article does not specify every possible post-exploitation action for this flaw. It does show why broad patching matters: CISA warned of significant federal-enterprise risk and urged all network defenders to update.

Both incidents show how quickly WordPress vulnerabilities can become active attack tools. CVE-2026-119977 is a high-severity WordPress Core flaw involving an upgrade race condition. The earlier wp2shell incident involved a critical chain that combined two WordPress Core vulnerabilities.

The wp2shell chain used REST API batch-route confusion, CVE-2026-63030, together with SQL injection, CVE-2026-60137. Attackers used it to deploy webshells and take over unpatched servers. Public exploits appeared one day after the patches were released, and breaches began a few days later.

The newer flaw has already been exploited, and Wordfence reported blocking 13,095 attacks in 24 hours. The article does not report equivalent successful-takeover figures for CVE-2026-119977. It does show a recurring lesson: once WordPress flaws are patched and publicized, unpatched installations can face rapid attack activity.

WordPress is a website publishing and content-management platform. Its core is the central software that provides essential site functions and receives security updates. The source focuses on that core upgrade process, rather than defining WordPress itself, so this broader description uses established background knowledge.

The incident matters because upgrading core software is a normal way to keep sites secure. CVE-2026-119977 abuses the upgrade window through a TOCTOU race condition and predictable, web-accessible staging paths. An unauthenticated remote attacker can potentially execute code on the server while the full package is being installed.

The article links WordPress installations to federal agencies, private organizations, small businesses, and government organizations. CISA called this vulnerability a significant risk to the federal enterprise and urged all network defenders to patch. WordPress released version 7.1.4 on October 28 and recommended immediate updates.