The US Cybersecurity and Infrastructure Security Agency (CISA) has reportedly warned that a high-severity vulnerability in WordPress Core is being exploited in real-world attacks. Identified as CVE-2026-119977, the flaw carries a reported CVSS severity score of 8.1 and could allow attackers to execute unauthorised code on vulnerable web servers without first obtaining valid login credentials.
The reported exploitation has raised concerns among website owners, hosting providers and organisations that rely on WordPress to manage their online operations. CISA's inclusion of the vulnerability in its Known Exploited Vulnerabilities (KEV) catalogue signals that the issue should be treated as an active security concern rather than a theoretical weakness.
Vulnerability Linked to WordPress Core Update Process
According to the supplied report, the security weakness is associated with temporary staging paths used during certain full-package WordPress Core updates.
The issue is described as a time-of-check to time-of-use (TOCTOU) race condition. This class of vulnerability occurs when a system checks a resource's status and then uses it later, creating a short interval in which the resource may be changed or interfered with.
Researchers at Wordfence reportedly identified and documented the vulnerability. The concern is that temporary update-related components may remain accessible during part of the maintenance process, potentially creating an opportunity for unauthorised interference.
The reported flaw does not depend on an attacker first logging in with a compromised administrator account. This makes the issue particularly important for website operators, although the reported exposure is associated with the specific conditions of the update process.
Security Monitoring Reports Rapid Increase in Suspicious Activity
The report cites monitoring data indicating that attackers began scanning for vulnerable WordPress installations soon after details of the flaw became public.
Wordfence reportedly recorded more than 18,500 requests probing relevant installer-related paths during the first 21 hours after disclosure. Its defensive telemetry also identified and blocked 12,632 attack attempts during a separate 24-hour observation period.
Cybersecurity firm Previdian reportedly detected three targeted attempts against its honeypot sensors on October 30, 2026. The activity originated from an IP address geolocated in the United Kingdom.
These figures indicate attempts to identify or target potentially vulnerable systems. They should not be interpreted as confirmation that the same number of websites were successfully compromised.
CISA Sets November 6 Remediation Deadline for Federal Agencies
Following reports of active exploitation, CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue and issued a binding operational directive for Federal Civilian Executive Branch agencies.
According to the supplied report, those agencies must address CVE-2026-119977 by November 6, 2026. Security fixes intended to address the reported weakness were published in late October.
The federal deadline applies to the agencies covered by the directive. Private businesses and other WordPress operators are not automatically subject to that same federal compliance requirement, but the reported exploitation makes timely security updates important for them as well.
What WordPress Website Owners Should Do
Website administrators should check their WordPress installations and confirm that the relevant security updates have been applied. They should also review their hosting provider's security guidance and monitor official WordPress and CISA advisories for confirmed technical details.
Organisations should pay particular attention to update management, access controls, security monitoring and the protection of temporary files used during maintenance. Routine security reviews can help identify weaknesses before they become larger operational problems.
For businesses that depend on their websites for customer communication or online services, regular control assessments are an important part of Shunyatax's internal audit services.
The incident is another reminder that even routine software maintenance can carry security risks. Keeping website software current and maintaining a structured security review process are essential steps in reducing exposure to emerging threats.