CISA Confirms Hackers Exploiting Word Press Core Flaw During Software Upgrades

Summary: CISA added a WordPress Core flaw, CVE-2026-119977 (CVSS 8.1), to its Known Exploited Vulnerabilities catalog, citing active exploitation of a TOCTOU race condition that allows unauthenticated code execution during full-package core upgrades via predictable, web-accessible staging paths. Wordfence recorded more than 18,500 requests targeting staged "setup-config.php" installer paths in the first 21 hours after public disclosure, and 12,632 exploitation attempts were blocked in the last 24 hours.
Why it matters: The attack needs no account on the site and only a brief window during a core update, so the upgrade itself is the exposure - and FCEB agencies have until November 6, 2026, to apply fixes.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-119977
Related: CISA Adds One Known Exploited Vulnerability to Catalog Cyber Risks · Nov 03, 2026
CVE-2026-119977: Word Press Word Press Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Known Exploited Vulnerabilities · Nov 03, 2026
Installing the Fix for an Exploited Word Press Flaw Can Expose Some Sites One Last Time Cyber Risks ·