WordPress Core Race Condition Flaw Under Active Attack, CISA Warns

5 November 2026

CISA has added a high-severity WordPress Core vulnerability (CVE-2026-119977) to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. The flaw is a Time-of-check Time-of-use (TOCTOU) race condition that allows unauthenticated attackers to execute arbitrary code on servers during the brief window of a Core upgrade, exploiting predictable staging paths. Federal agencies have until November 6, 2026, to apply the available patches, while security firms have already recorded tens of thousands of exploitation attempts since the vulnerability was publicly disclosed.

CISA has added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog after confirming attackers are actively going after it in the wild.

The flaw, CVE-2026-119977, scores 8.1 on the CVSS scale and is a Time-of-Check Time-of-Use (TOCTOU) race condition. The practical upshot: an unauthenticated attacker can potentially execute arbitrary code on a vulnerable server, but only during the narrow window when a full WordPress Core upgrade is running. Patches dropped late last month.

The root cause is surprisingly basic. WordPress uses predictable, publicly accessible staging paths during core upgrades. If you know what to look for and time it right, you can slip malicious requests in before the update completes. No account required.

Wordfence broke the technical details last week, and the internet wasted no time. Within 21 hours of public disclosure, the security firm had logged over 18,500 requests probing for the exposed "setup-config.php" installer paths. At the time of writing, more than 12,600 exploitation attempts had been blocked in just the previous 24 hours.

Honeypot data from Previdian adds some colour. Three exploitation attempts were recorded from a UK-geolocated IP address on October 30, 2026, suggesting real-world probing beyond automated scanners.

Federal Civilian Executive Branch agencies have until November 6, 2026 to apply the fix. Everyone else should probably not wait that long.

READ NEXT

CISA Adds PHP2Shell RCE Flaws to Active Exploitation List as 32 Million Servers Sit Unpatched Half a Million WordPress Sites Running Vulnerable Form Plugin — 300,000 Still Unpatched CVSS 10.0: LXD and MicroCloud Bug Let Attackers Impersonate Trusted Clients With No Private Key Required