CISA Issues Warning Over Active Exploitation of High-Severity WordPress Vulnerability
The US Cybersecurity and Infrastructure Security Agency (CISA) has warned federal agencies that attackers are actively exploiting a recently patched, high-severity vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, allows remote code execution and has been added to CISA's Known Exploited Vulnerabilities Catalog.
BleepingComputer
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies regarding the active exploitation of a recently patched high-severity vulnerability within WordPress.
Tracked as CVE-2026-119977, the flaw is a Time-of-check Time-of-use (TOCTOU) race condition in WordPress Core. The vulnerability was initially reported by Picus Security researcher Umut Bayram.
Successful exploitation of this flaw allows remote threat actors without privileges to execute code on the server. This is possible due to predictable, web-accessible staging paths utilized during full-package core upgrades.
The WordPress security team released version 7.1.4 on October 28 to address the security issue. The team advised users that because this is a security release, immediate updates are strongly recommended.
CISA confirmed the active exploitation of CVE-2026-119977 on Tuesday and has added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog. Federal Civilian Executive Branch (FCEB) agencies have been ordered to secure their systems by Friday under Binding Operational Directive (BOD) 26-04.
CISA emphasized that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. While the directive targets US federal agencies, CISA urged all network defenders, including those in the private sector, to prioritize patching.
In real-time threat monitoring, the security firm Wordfence reported in an advisory update that it had blocked 13,095 attacks targeting this specific vulnerability within the past 24 hours.
This incident follows a previous critical vulnerability chain, wp2shell, patched in July. That chain involved CVE-2026-63030 and CVE-2026-60137, which allowed attackers to deploy webshells. A Chinese-speaking threat actor subsequently weaponized this exploit chain in September to steal sensitive data from over 18,500 records belonging to small businesses and government organizations.