The U.S. Government Issues Warning Over Vulnerability in WordPress Core
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark warning regarding the exploitation of a critical vulnerability in WordPress Core, which could enable the execution of malicious code on website servers.
On November 3, 2026, CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, substantiating the reality of active exploitation and emphasizing the urgency of immediate remediation efforts.
Designated CVE-2026-119977, this vulnerability impacts WordPress Core versions ranging from 4.7 to 7.1.3, boasting a high severity CVSS score of 8.1.
Intriguingly, attackers can exploit this flaw without possessing a valid user account or requiring any user interaction.
However, the exploitation hinges on the precise timing during a complete WordPress Core upgrade, as opposed to merely accessing any affected site.
This vulnerability derives from the predictable temporary folders created during the update process. When WordPress extracts a full upgrade package, it temporarily positions files in a staging directory located beneath wp-content/upgrade.
In systems that are vulnerable, these files can be accessed via the web while the server is still undertaking the update process, intermittently revealing a separate copy of the WordPress installer.
An assailant who accesses this installer before cleanup is finalized could connect the staged installation to a database they control, thus paving the way for code execution on the server.
This scenario exemplifies a time-of-check, time-of-use race condition, commonly referred to as TOCTOU. The success of the attack relies on accessing temporary files before WordPress eliminates them.
Despite the fleeting opportunity it presents, this flaw is far from benign. A report from Cybersecuritynews.com on remote code execution attacks targeting WordPress highlighted over 18,500 requests aimed at staged installer paths within just the first 21 hours of monitoring.
Continuous requests may enable attackers to exploit the brief upgrade window; however, such requests do not provide definitive proof of a successful breach.
WordPress Core Vulnerability Exploited
The official alert from CISA confirms the exploitation of this vulnerability, yet does not disclose details about the attackers or the number of websites affected.
The catalog entry enhances the impetus for defenders to prioritize this issue beyond merely its severity rating.
CISA further implores organizations outside the government sphere to address known exploited vulnerabilities via a risk-based patching approach.
A separate report from Cybersecuritynews.com, documenting over 60,000 attempted attacks on WordPress, noted 60,471 blocked attempts within a 24-hour window.
This figure pertains to firewall activity rather than unique victims or confirmed infections. Distinguishing these categories is critical when assessing the magnitude of such campaigns and interpreting monitoring data accurately.
In response to this vulnerability, WordPress released version 7.1.4 on October 28, 2026, to rectify the upgrade flaw alongside other security concerns.
The official security announcement acknowledges researcher Umut Bayram for identifying the flaw and advises users to implement updates promptly.
Additionally, WordPress announced backports for applicable older branches, clarifying that only the latest version enjoys active support.
Site administrators are advised to access the Dashboard, navigate to Updates, and confirm that the security release has been successfully installed.
Even sites utilizing automatic background updates must perform this verification. Until comprehensive patching is achieved, limiting public web access to the upgrade directory can mitigate exposure risks.
While a firewall serves as a vital defensive layer, it should complement—not replace—the task of rectifying WordPress Core.
Moreover, defenders should meticulously examine server logs for any unusual requests directed towards PHP files located under wp-content/upgrade and should investigate any unfamiliar administrator accounts, plugins, or file modifications.
Such vigilance aids in identifying potential red flags warranting further inquiry, without prematurely interpreting every blocked request as indicative of a breach.
Source link: Cybersecuritynews.com.
