Skip to content

Back to the catalog

CISA flags WordPress RCE flaw as actively exploited in attacks
bleepingcomputer.comarticle

CISA flags WordPress RCE flaw as actively exploited in attacks

CVE-2026-119977 is a high-severity WordPress Core TOCTOU race condition that allows unauthenticated remote code execution during full-package core upgrades, via predictable web-accessible staging paths. WordPress 7.1.4 patched it on October 28, and CISA added it to the KEV Catalog with a BOD 26-04 deadline for federal agencies. Wordfence reported blocking 13,095 attacks in 24 hours; the article also recaps the July 2026 wp2shell chain.

TL;DR CISA added the WordPress Core upgrade-race RCE CVE-2026-119977 to KEV after exploitation, with the fix in WordPress 7.1.4.
Open original ↗
Document

What it is

CVE-2026-119977 is a high-severity WordPress Core flaw, a Time-of-check Time-of-use (TOCTOU) race condition in the upgrade process. Picus Security researcher Umut Bayram reported it. WordPress 7.1.4, released on October 28, 2026, fixes it. CISA confirmed active exploitation and added it to the Known Exploited Vulnerabilities (KEV) Catalog.

How it works

During full-package core upgrades, WordPress uses predictable, web-accessible staging paths. An unauthenticated remote attacker can race the upgrade window and execute code on the server. The page rates attack complexity as high. It gives no exploit details beyond this.

Preconditions / Affected

  • The site must be unpatched, below 7.1.4.
  • The attacker needs no privileges.
  • Exposure is greatest while an upgrade is running, since the WordPress security team describes the flaw as RCE "during the upgrade window".

What to do

  • Update to WordPress 7.1.4. The WordPress security team calls this a security release and recommends updating immediately.
  • Federal civilian agencies (FCEB) must secure their systems by the Friday after CISA's Tuesday listing, under BOD 26-04.
  • CISA urges private-sector defenders to prioritise this patch too, although the directive does not bind them.

Caveats

CISA gave no details on who is exploiting the flaw or how. The only volume figure is from Wordfence, which said in a weekend advisory update that it blocked 13,095 attacks on this vulnerability in 24 hours. The page names no workaround and no indicators of compromise.

Related: wp2shell

The page recaps the July 2026 wp2shell chain in WordPress Core. It combines a REST API batch-route confusion bug (CVE-2026-63030) with an SQL injection flaw (CVE-2026-60137). Public exploits appeared one day after the patches. Attackers then deployed persistent webshells and malicious plugins on unpatched servers within days. In September 2026 a Chinese-speaking threat actor used the chain to steal more than 18,500 records from the backend databases of small businesses and government organisations. Sites that lagged on the July patches were the ones exposed.

Organisations named here

  • CISA
  • Picus Security

CVEs named here

  • CVE-2026-119977
  • CVE-2026-63030
  • CVE-2026-60137

Technologies named here

  • Known Exploited Vulnerabilities Catalog
  • WordPress Core
  • Wordfence
  • WordPress
  • CISA KEV
  • WordPress REST API (batch-route confusion, CVE-2026-63030)

Standards and laws named here

  • BOD 26-04

Techniques named here

  • Time-of-check Time-of-use Race Condition
  • Remote code execution
  • SQL injection
  • Web shell deployment
  • Malicious plugin installation

Concepts named here

  • Active exploitation
  • Binding Operational Directive 26-04
  • Patch-to-exploit window
  • Umut Bayram

Threat actors named here

  • wp2shell
  • Chinese-speaking threat actor (weaponized the wp2shell exploit chain in September 2026 to steal more than 18,500 records from backend databases of small businesses and government organizations)

Related in AppSec