Wordfence reported it "blocked 13,095 attacks targeting this vulnerability in the past 24 hours," a sharp signal that attackers have begun exploiting a high-severity WordPress flaw tracked as CVE-2026-119977.
CVE-2026-119977: a TOCTOU race condition in WordPress Core
The flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition in WordPress Core that can enable unauthenticated remote code execution during a narrow upgrade window. Picus Security researcher Umut Bayram reported the issue, and WordPress issued a fix on October 28 with the release of WordPress 7.1.4. As the WordPress security team explained, "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window." The team also recommended immediate updates: "Because this is a security release, it is recommended that you update your sites immediately."
CISA confirms active exploitation and adds the flaw to the KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) told federal agencies it had confirmed active exploitation of CVE-2026-119977 and added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. Under Binding Operational Directive (BOD) 26-04, CISA ordered Federal Civilian Executive Branch (FCEB) agencies to secure affected systems by Friday. The agency framed the risk bluntly: "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." CISA also urged private-sector network defenders to prioritize patching, even though BOD 26-04 applies only to federal agencies.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleObserved activity and the shadow of earlier WordPress attacks
While CISA did not provide further technical specifics about active exploits, telemetry published by the WordPress-focused security firm Wordfence showed intense activity: the firm said it blocked 13,095 exploitation attempts in a 24‑hour period. The alert follows a summer incident that demonstrates how rapidly WordPress Core flaws can be weaponized. In July, the WordPress security team patched a critical vulnerability chain (nicknamed wp2shell) that combined a REST API batch-route confusion vulnerability (CVE-2026-63030) with an SQL injection flaw (CVE-2026-60137). Public exploits for the wp2shell chain appeared one day after the patches were released, and attackers began using those exploits to deploy persistent webshells and malicious plugins on unpatched servers within days. In September, a Chinese-speaking threat actor that weaponized wp2shell stole sensitive data from more than 18,500 records in backend databases belonging to small businesses and government organizations.
Why the upgrade window matters: predictable staging paths and attack complexity
CVE-2026-119977 is notable because exploitation leverages predictable, web-accessible staging paths created during full-package core upgrades. That predictability opens a narrow but dangerous window when unprivileged remote actors can race the upgrade process and place malicious code where WordPress will later execute it. The vulnerability is classified high-severity and characterized as high-complexity by the reporting, meaning exploitation requires precise timing and knowledge of the upgrade staging behavior—but is nevertheless feasible in the wild, as the recent blocking telemetry reflects.
What this means for FCEB agencies, security teams, and WordPress site owners
- Federal Civilian Executive Branch (FCEB) agencies: CISA's KEV listing triggers a binding deadline under BOD 26-04—agencies were ordered to secure affected systems by Friday. That deadline converts the advisory into a compliance requirement for covered federal entities.
- Technologists and security teams (private sector): CISA explicitly urged nonfederal network defenders to prioritize patching despite the directive's federal scope; Wordfence's blocked-attempt count indicates exploit attempts are already widespread and high-volume.
- WordPress site owners and administrators: The WordPress security team recommended immediate updates to WordPress 7.1.4 to close the upgrade-window TOCTOU vector that enables remote code execution.
CVE-2026-119977 joins a short list of Core-level WordPress flaws that have produced rapid, automated exploitation once public patches or proof-of-concept code existed. CISA has confirmed active abuse but offered limited technical detail; Wordfence's blocking telemetry and the prior wp2shell incidents together underscore how quickly attackers can pivot from disclosure or patching to mass scanning and exploitation. For now, the clear next steps spelled out by the record are simple and concrete: update to WordPress 7.1.4 and, for federal agencies, meet CISA's BOD 26-04 deadline.
