The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark warning regarding the exploitation of a critical vulnerability within WordPress Core that enables the execution of malicious code on compromised website servers.
On November 3, 2026, CISA added this vulnerability to its Known Exploited Vulnerabilities catalog, substantiating the evidence of ongoing exploitation and underscoring the urgent necessity for prompt remediation.
Designated as CVE-2026-119977, this vulnerability influences WordPress Core versions ranging from 4.7 to 7.1.3 and has been assigned a high severity CVSS score of 8.1.
Notably, attackers are able to exploit this flaw without requiring a valid user account or user interaction.
However, successful exploitation hinges on precise timing during a comprehensive WordPress Core update, rather than merely visiting a site operating an affected version.
The inherent weakness is attributed to predictable temporary folders created during the update process. In scenarios where WordPress extracts a full upgrade package, files are deposited into a staging directory beneath wp-content/upgrade.
On affected setups, these files may be accessed via the web while the server is still finalizing the update, thereby briefly exposing a duplicate copy of the WordPress installer.
If an attacker accesses the installer prior to its cleanup completion, they could connect the staged installation to a database within their control, establishing a route toward server-side code execution.
This occurrence describes a time-of-check, time-of-use race condition, commonly referred to as TOCTOU, where the attack relies on accessing temporary files before WordPress purges them.
This fleeting exposure does not mitigate the severity of the flaw. Reports from Cybersecuritynews.com regarding remote code execution attacks on WordPress highlighted over 18,500 requests targeting staged installer paths during the initial 21 hours of monitoring.
While numerous requests can facilitate attackers in capitalizing on the brief upgrade window, such requests do not inherently confirm a breach.
Exploitation of WordPress Core Vulnerability
The official alert from CISA acknowledges the exploitations but refrains from identifying the perpetrating entities or specifying the number of compromised websites.
The catalog entry furnishes defenders with compelling justification to prioritize the vulnerability, transcending its gravity score.
CISA also implores organizations, extending beyond government sectors, to address known exploited vulnerabilities through a risk-based patching approach.
A report from Cybersecuritynews.com, analyzing over 60,000 WordPress attack attempts, disclosed that 60,471 of these attempts were blocked within a 24-hour timeframe.
This figure reflects instances of firewall activity and does not account for unique victims or verified infections. It is crucial to distinguish these categories when assessing the magnitude of a campaign and interpreting the implications of monitoring data.
On October 28, 2026, WordPress rolled out version 7.1.4 to rectify the upgrading vulnerability alongside other security concerns.
The official security announcement recognizes researcher Umut Bayram for revealing the flaw and strongly recommends that users apply the update without delay.
Furthermore, WordPress has introduced backports for eligible older versions, while indicating that only the most recent release will continue to receive active support.
Website administrators are advised to navigate to the Dashboard, select Updates, and confirm the successful installation of the security release.
Sites utilizing automatic background updates must still perform this verification. Until the patching process is fully realized, limiting public web access to the upgrade directory can mitigate exposure risks.
Additionally, a firewall should serve as an auxiliary layer of fortification, rather than a substitute for rectifying the WordPress Core issue.
Defensive measures should include a thorough review of server logs for anomalous requests directed at PHP files situated within wp-content/upgrade, as well as an investigation into any unfamiliar administrator accounts, plugins, or file modifications.
These examinations can help unveil signs warranting further scrutiny, without misconstruing every blocked request as evidence of a compromise.
Source link: Cybersecuritynews.com.
