WordPress Core CVE-2026-119977: CISA Confirms Unauthenticated RCE Exploited During Upgrade Windows
In late October 2026, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical Time-of-Check Time-of-Use (TOCTOU) race condition in WordPress Core. The flaw, carrying a CVSS score of 8.1, allows unauthenticated attackers to execute arbitrary code on affected servers by targeting predictable, web-accessible staging paths exposed during full-package Core upgrades. Within 21 hours of public disclosure, over 18,500 exploit attempts were recorded against staged setup-config.php installer paths. Honeypot telemetry confirmed live exploitation on October 30, 2026, with FCEB agencies mandated to patch by November 6, 2026. This incident underscores the growing attacker focus on transient vulnerability windows—brief intervals during routine maintenance operations such as software upgrades—where security controls are momentarily relaxed. The mass exploitation speed mirrors trends seen in zero-day campaigns targeting internet-facing infrastructure, signaling that threat actors are increasingly automating opportunistic scanning and exploitation pipelines against well-known CMS platforms.
Kill Chain
