The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed the exploitation of a WordPress core vulnerability and added it to its Known Exploited Vulnerabilities catalog, known as KEV, on November 3. The flaw, CVE-2026-119977, could allow an unauthenticated attacker to execute code on the server while a full WordPress update is being installed.
The issue has a CVSS score of 8.1 and stems from a TOCTOU (time-of-check time-of-use) race condition. The risk window occurs during the update process: predictable, web-accessible staging paths can expose temporary files before installation is complete. WordPress released a fix in version 7.1.4 on October 28.
“WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the update window. This is due to predictable, web-accessible staging paths used during full core updates.”
— CISA
The attack depends on a brief update window
The vulnerability does not require the attacker to have an account on the site, but they must exploit the interval in which a full core update is being prepared. According to CISA's description, the risk lies in staging paths exposed during this process. Server-side code execution is a possible outcome if an attacker exploits the race condition while the update is underway.
The Hacker News reported that technical details became public the week before the vulnerability was added to KEV. Wordfence, the WordPress security company cited by the outlet, said that no account is required and that the attack must coincide with the brief window of a full update. This is not, therefore, evidence that any vulnerable installation can be attacked at any time: the update process is part of the conditions described.
The flaw affects WordPress Core versions earlier than 7.1.4, according to the Canadian Centre for Cyber Security advisory. Previdian specifies that affected versions range from 4.7 to 7.1.3. WordPress announced that security patches are also being backported to eligible branches, currently down to 4.7; those backports will be distributed as they are ready. The announcement notes that only the latest version receives active support.
More than 18,500 requests in the first 21 hours
Signs of activity appeared before CISA's confirmation. Wordfence recorded more than 18,500 requests targeting prepared “setup-config.php” installer paths during the first 21 hours after public disclosure. At the time of the report, 12,632 exploitation attempts had been blocked in the preceding 24 hours.
Previdian observed three attempts against its sensors, all from an IP address geolocated in the United Kingdom. The events were detected on October 30, 2026. Its data details a single attacker IP, one country, and one sensor; the company says its observations do not prove that the target was vulnerable or that the attempts succeeded.
Previdian's timeline places the first observation by its sensors on October 30. That same day, it added the case to its exploited vulnerabilities feed, and the CVE identifier was reserved. The identifier was assigned on November 2; CISA added the vulnerability to KEV on November 3. On November 4, The Hacker News reported the confirmation and active exploitation.
The Hacker News notes that U.S. Federal Civilian Executive Branch agencies have until November 6, 2026 to apply the fixes. The addition to the catalog confirms exploitation, but does not by itself identify which sites may have been compromised.
WordPress 7.1.4 includes several security fixes
WordPress released version 7.1.4 on October 28 as a security update and recommended installing it immediately. The fix for the remote code execution vulnerability during updates was one of several included. The WordPress announcement also lists stored cross-site scripting (XSS) flaws, issues in the Interactivity API, exposure of unpublished Customizer changes, and an update to the bundled root certificates following eMudhra's revocation.
Among the issues detailed, WordPress credited Anthropic with reporting that privacy data erasure requests could trigger stored XSS, as well as another issue involving specially crafted user logins. Rafie Muhammad of Awesome Motive, Inc. reported an XSS in block markup and another in the Customizer's selective refresh. Ben Bidner of the WordPress security team reported issues in the Categories and Playlist blocks and with images. The announcement also identifies several reports involving the Interactivity API and comment pagination blocks.
The release is a short-cycle release; WordPress said the next major release, 7.2, was scheduled for December 8. It also announced WordPress 7.2 Beta 3, which contains the applicable fixes. Backports for branches receiving security updates were underway when the announcement was published.
Applying the patch and investigating are separate tasks
The Canadian Centre for Cyber Security published advisory AV26-1117 on November 3. It identifies WordPress Core versions earlier than 7.1.4 as affected, reports that CVE-2026-119977 was added to KEV, and recommends that users and administrators review the relevant updates. WordPress offers version 7.1.4 for download and also allows users to start the update from the administration dashboard; sites that support automatic updates may receive it in the background.
Park Labs distinguishes between installing the fix and determining whether there was earlier activity. To assess a site, it suggests checking the core version, update logs, and requests received during the process, as well as preserving logs and files if an intrusion is suspected. These checks do not confirm that a specific site was attacked; nor does the telemetry published by Previdian establish that its attempts resulted in code execution.
CISA's alert comes after the patch was released and the first attempts were observed in late October. For administrators, the next practical step is to verify that the installation is running a version that includes the fix; for U.S. federal civilian agencies, the stated deadline to apply it is November 6.
Sources: The Hacker News, Canadian Centre for Cyber Security, WordPress News, Previdian, Park Labs
