WordPress Core Flaw Actively Exploited During Updates
CISA confirms hackers are exploiting a critical WordPress Core vulnerability during software upgrades. The flaw allows remote code execution and has been added to the KEV catalog.
TL;DR
- CISA adds WordPress Core flaw CVE-2026-119977 to its Known Exploited Vulnerabilities list
- The vulnerability is a TOCTOU race condition with a CVSS score of 8.1
- Attackers exploit the flaw during WordPress upgrade processes
- Successful exploitation leads to arbitrary code execution on affected sites
- Organizations using WordPress should patch immediately and monitor for signs of compromise
A serious security flaw in WordPress Core is under active exploitation by threat actors, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The agency has added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog after confirming real-world attacks.
The vulnerability represents a Time-of-check Time-of-use (TOCTOU) race condition that can be triggered during WordPress software upgrade procedures. With a CVSS severity score of 8.1, this high-impact issue enables attackers to execute arbitrary code on vulnerable installations.
Technical Details
- CVE-2026-119977 is classified as a Time-of-check Time-of-use (TOCTOU) race condition
- The flaw carries a CVSS base score of 8.1, indicating high severity
- Exploitation occurs specifically during WordPress core software upgrade operations
- Successful attacks can lead to complete system compromise through arbitrary code execution
- The vulnerability affects WordPress installations during legitimate update processes
Security Response
- CISA has officially listed CVE-2026-119977 in its Known Exploited Vulnerabilities catalog
- Federal agencies are required to remediate the vulnerability according to established timelines
- WordPress site administrators should apply available patches immediately
- Organizations should audit their systems for indicators of compromise related to this flaw
- Security teams need to monitor upgrade activities and implement additional access controls during maintenance windows
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.