CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Ravie LakshmananNov 04, 2026Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers. Patches for the flaw were released late last month. "WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window," CISA said. "This is due to predictable, web-accessible staging paths used during full-package core upgrades." Details of the flaw emerged last week when Wordfence said exploiting the vulnerability does not require an account on the site. That said, it does require an attacker to exploit a brief window during a complete Core update that could allow unauthenticated code execution. During the first 21 hours after public disclosure, the WordPress security company said it recorded more than 18,500 requests targeting staged "setup-config.php" installer paths. As of writing, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours. Telemetry data from Previdian shows that three exploitation attempts have been recorded against its honeypot censors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026. With exploitation now officially confirmed by CISA, Federal Civilian Executive Branch (FCEB) agencies have time until November 6, 2026, to apply the fixes. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, Vulnerability, Web Security, WordPress American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens AI-Generated Fake Login Pages Are Making Account Takeovers Easier TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Your Attack Surface Is Growing Faster Than Your Team Can Respond PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security