The US Cybersecurity and Infrastructure Security Agency (CISA) has alerted federal agencies to ongoing attacks exploiting a recently patched critical vulnerability in WordPress Core. Designated CVE-2026-119977, the flaw originates from a Time-of-check Time-of-use (TOCTOU) race condition discovered by Picus Security researcher Umut Bayram.
The vulnerability permits unauthenticated attackers to execute arbitrary code on affected servers through complex exploitation chains that leverage predictable, publicly reachable staging directories created during complete core updates.
When WordPress released version 7.1.4 on October 28 to address the issue, the security team emphasized the urgency of immediate deployment. "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window," the team stated, adding that "it is recommended that you update your sites immediately."
CISA confirmed Tuesday that the vulnerability is being actively exploited and subsequently added it to its Known Exploited Vulnerabilities (KEV) Catalog. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must remediate the issue by Friday. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA warned.
Although the directive applies specifically to US federal agencies, CISA encouraged all organizations, including private sector entities, to treat patching this vulnerability as a priority to defend their infrastructure.
While CISA provided limited specifics on the exploitation campaign, WordPress security vendor Wordfence reported blocking 13,095 attacks targeting the vulnerability within a single 24-hour period over the weekend.
Earlier WordPress vulnerabilities also under active attack
This incident follows a pattern of critical WordPress vulnerabilities being weaponized shortly after patches become available. In July, the WordPress security team released fixes for a critical vulnerability chain dubbed wp2shell, which combined a REST API batch-route confusion flaw (CVE-2026-63030) with an SQL injection vulnerability (CVE-2026-60137) to enable webshell deployment and server takeover.
Public exploits for wp2shell appeared within a day of the patches, and attackers began compromising unpatched installations within days to establish persistent webshells and deploy malicious plugins.
A Chinese-speaking threat actor later weaponized the wp2shell chain in September, compromising more than 18,500 records from backend databases belonging to small businesses and government organizations to extract sensitive information.