CISA Flags Actively Exploited WordPress Remote Code Execution Flaw

CISA, the US Cybersecurity and Infrastructure Security Agency, has added a high-severity WordPress Core vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue. The agency confirmed that attackers are actively exploiting the flaw, which is tracked as CVE-2026-119977.

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition that occurs during the WordPress upgrade process. By exploiting predictable, web-accessible staging paths used during full-package core upgrades, remote threat actors without existing privileges can achieve remote code execution (RCE) on the target server.

Scale of Exploitation

While specific details regarding the threat actors involved have not been released, the scale of the threat is significant. WordPress security firm Wordfence reported blocking 13,095 attacks targeting this specific vulnerability in a single 24-hour period over the weekend.

CISA has issued a directive to Federal Civilian Executive Branch (FCEB) agencies, ordering them to secure their systems against the flaw by Friday. Although the mandate specifically targets US federal agencies, CISA has urged private sector network defenders to prioritise patching to mitigate the risk to their own servers.

Mitigation and Historical Context

The WordPress security team released a patch for the vulnerability on 28 October as part of the WordPress 7.1.4 release. Administrators are advised to update their sites to this version immediately to prevent unauthorised access.

This incident follows a pattern of critical vulnerabilities affecting the WordPress platform. In July, researchers identified a vulnerability chain known as “wp2shell,” which involved a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137). That exploit chain was weaponised by a Chinese-speaking threat actor in September to compromise more than 18,500 records belonging to small businesses and government organisations.