"WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window," CISA said.
CVE-2026-119977: a TOCTOU race condition in WordPress Core
CISA added a high-severity flaw in WordPress Core to its Known Exploited Vulnerabilities (KEV) catalog after finding evidence of active exploitation. The vulnerability is tracked as CVE-2026-119977 and carries a CVSS score of 8.1. CISA described the defect as a time-of-check time-of-use (TOCTOU) race condition that could be abused to achieve arbitrary code execution on affected servers. According to the agency, the window of opportunity exists "during the upgrade window" because of predictable, web-accessible staging paths used during full-package core upgrades. Patches for the flaw were released late last month.
Wordfence telemetry: thousands of probe attempts and recent blocks
Details of the flaw surfaced after reporting from Wordfence, which said the vulnerability can be exploited without an account on the target site, though an attacker must hit a brief window during a complete Core update. Wordfence recorded more than 18,500 requests targeting staged "setup-config.php" installer paths in the first 21 hours after public disclosure. The security company also reported that 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours as of the time of its reporting.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPrevidian honeypot detections: three attempts from a U.K. IP
Telemetry from Previdian showed three exploitation attempts against its honeypot censors originating from an IP address geolocated in the U.K. Those events were observed on October 30, 2026. Previdian's data offers a narrow but concrete signal that scanning and attempted exploitation began quickly and included distributed probes against exposed staging paths.
CISA’s KEV listing and the November 6 FCEB deadline
By adding CVE-2026-119977 to the KEV catalog, CISA signaled that the agency regards exploitation as active and sufficiently widespread to require prioritized mitigation. The listing carries an operational consequence for Federal Civilian Executive Branch (FCEB) agencies: they have until November 6, 2026, to apply the published fixes. CISA’s public language links the root cause to "predictable, web-accessible staging paths used during full-package core upgrades," underscoring that the vulnerability is tied to the upgrade process rather than typical runtime request handling.
What this means for technologists, FCEB agencies, and site operators
- Technologists and security teams: Rapid verification and patching of WordPress Core installations — and monitoring of upgrade-stage endpoints such as staged setup-config.php paths — will be central actions. The exploit’s unauthenticated nature and the short timing window change risk calculations for automated update workflows and maintenance windows.
- Federal Civilian Executive Branch agencies: The November 6, 2026 deadline for applying fixes sets a firm compliance milestone. Agencies must inventory WordPress Core usage in their environments, confirm patch deployment, and validate that upgrade staging paths are not web-accessible during updates.
- Site operators and administrators: The volume of probes and blocked attempts reported by Wordfence, together with the honeypot sightings, suggests active scanning and exploitation attempts against public-facing WordPress sites. Operators should apply the available patches and review how their upgrade processes create or expose predictable staging paths.
The facts in the record are stark: a high-severity TOCTOU flaw (CVE-2026-119977) with an 8.1 score, public patches issued late last month, tens of thousands of targeted requests recorded soon after disclosure, three honeypot hits from a U.K.-geolocated IP on October 30, 2026, and a CISA-mandated remediation deadline for FCEB agencies of November 6, 2026. Those elements together map a narrow technical defect into an operational urgency — one measured in hours for many administrators, and in days for government agencies bound by the KEV calendar.
