The U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added a critical WordPress Core vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on November 3, 2026, confirming that malicious cyber actors are actively exploiting the flaw in the wild. Tracked as CVE-2026-119977, the security defect stems from a Time-of-check Time-of-use (TOCTOU) race condition in the content management system's core updater routine. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies have been ordered to remediate the vulnerability across all internet-exposed assets by November 6, 2026, mitigating immediate risks of remote code execution and total host compromise.
Eighteen-Year-Old TOCTOU Race Condition Enables Remote Code Execution
Eighteen-Year-Old TOCTOU Race Condition Enables Remote Code Execution
Discovered and responsibly reported by Umut Bayram, a security researcher at Picus Security, CVE-2026-119977 carries a high-severity CVSS score of 8.1. According to CISA's official catalog bulletin, "WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades."
Technical analyses reveal that during a core update utilizing a complete package, the updater unpacks a copy of the new version into a temporary folder within wp-content/upgrade. That temporary package contains the WordPress installer files, including setup-config.php. On installations running WordPress 5.9 through 7.1.3, the unpatched updater code predictably names the staging folder after the downloaded archive file, leaving it reachable via direct HTTP requests. An unauthenticated attacker needs no user account on the target system. By timing requests to reach the staged installer during the brief upgrade race window, an attacker can configure the staged instance with an attacker-controlled external database, establish an administrative account, upload malicious PHP code, and take over the live hosting environment. Bayram traced the root behavior back to WordPress 2.7 released in 2008, revealing that the architectural flaw remained hidden for nearly 18 years. The WordPress Security Team released version 7.1.4 alongside backported patches for branches dating back to 4.7 on October 28, 2026.
The One Last Exposure Dilemma and Upstream Hardening Guidance
The "One Last Exposure" Dilemma and Upstream Hardening Guidance
Security researchers highlighted an acute paradox during remediation: upgrading from a vulnerable version executes the old, unpatched updater code currently resident on the server one last time. As Bayram told media reporters, the deciding factor "isn't partial versus complete. It's whether the updater already installed on the site has been fixed." Because the legacy unpacking routine runs before patched files are in place, the predictable staging folder can still be accessed if an attacker strikes during that window.
To eliminate this residual hazard, researchers recommend two critical administrative workflows before updating. First, site administrators should block web access to the wp-content/upgrade directory at the web server level. On Nginx servers, administrators should insert a rule denying access to that URI pattern. On Apache servers, administrators must configure a Require all denied directive inside a Directory block, or place a 403 redirect rule in the root .htaccess file. Administrators are cautioned never to place .htaccess inside the upgrade directory itself, because the unpatched updater wipes all folder contents prior to unpacking. Second, administrators with shell access can perform an out-of-web-root manual update by extracting files outside the public directory tree and copying core components without touching wp-config.php or wp-content. Enterprise defenders should also inspect server access logs for anomalous requests to setup-config.php, audit accounts for rogue administrators, scan for unexpected PHP files, and monitor whether web server processes spawn system utilities such as curl, wget, or Python.
Global Telemetry Captures Over 240,000 Automated Exploitation Probes
Global Telemetry Captures Over 240,000 Automated Exploitation Probes
Real-time telemetry gathered by cybersecurity monitoring platforms confirms heavy, automated scanning campaigns targeting the flaw. Because the race window typically lasts only seconds in lab testing, threat actors deploy automated scripts that poll sites continuously to catch active update operations. Wordfence observed initial exploit probes just 9 minutes after deploying its firewall protection rule on October 28. Within the first 21 hours of public disclosure, Wordfence logged over 18,500 requests directed at staged setup-config.php paths.
To date, Wordfence has blocked over 240,000 exploit attempts, with activity peaking on October 30 when more than 74,000 attempts were repelled in 24 hours. The vendor recorded 12,632 attack attempts over a recent 24-hour cycle. The two most persistent sources sustained automated polling across target clusters for approximately 14.5 hours. Prominent offending IPs include 103.59.160.171 with over 74,900 blocked requests, 2001:df1:e8c0::106b with over 40,400 requests, and 51.89.103.78 with over 34,600 requests. Additionally, threat intelligence firm Previdian recorded three honeypot exploitation attempts originating from a United Kingdom IP address on October 30. With public exploit code circulating on GitHub, CISA urges organizations to immediately deploy WordPress 7.1.4 and conduct forensic log reviews for anomalous installer requests.
