CISA flags WordPress RCE flaw as actively exploited in attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild.

Tracked as CVE-2026-119977, this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram.

Successful exploitation can let remote threat actors without privileges execute code on the server in high-complexity attacks due to predictable, web-accessible staging paths used during full-package core upgrades.

"A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window," the WordPress security team said on October 28 when it released WordPress 7.1.4 with patches to address this security issue. "Because this is a security release, it is recommended that you update your sites immediately."

CISA confirmed CVE-2026-119977 active exploitation on Tuesday and added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Friday, as mandated by Binding Operational Directive (BOD) 26-04.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the cybersecurity agency warned.

Although BOD 26-04 targets only US federal agencies, CISA urged all network defenders, including those in the private sector, to prioritize patching this vulnerability to protect their servers.

While CISA didn't provide more details on attackers exploiting CVE-2026-119977 in the wild, WordPress security firm Wordfence says in an advisory update over the weekend that it "blocked 13,095 attacks targeting this vulnerability in the past 24 hours."

In July, the WordPress security team also patched a critical vulnerability chain in WordPress Core (named wp2shell) that can be abused to deploy webshells and take over unpatched servers by exploiting a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137).

Public wp2shell exploits were released one day after the patches went live, and attackers began breaching unpatched servers a few days later to deploy persistent webshells and install malicious plugins.

A Chinese-speaking threat actor also weaponized the wp2shell exploit chain in September to steal sensitive data from more than 18,500 records stored in backend databases belonging to small businesses and government organizations.