Federal Agencies on High Alert as Critical WordPress Vulnerability is Actively Exploited
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory to federal agencies regarding the exploitation of a recently patched high-severity vulnerability in WordPress.
Identified as CVE-2026-119977, this significant flaw arises from a Time-of-Check to Time-of-Use (TOCTOU) race condition, a vulnerability brought to light by Umut Bayram, a researcher at Picus Security.
If successfully exploited, this weakness can grant remote adversaries the capacity to execute arbitrary code on the server, complicating attacks due to predictable staging paths accessible on the web during full-package core upgrades.
“During the upgrade process, a flaw can lead to remote code execution,” the WordPress security team elucidated on October 28, coinciding with the release of WordPress version 7.1.4, which included critical patches for this security vulnerability. “Given the nature of this release, it is imperative to update your websites posthaste.”
On Tuesday, CISA validated the active exploitation of CVE-2026-119977 and incorporated this flaw into its Known Exploited Vulnerabilities (KEV) Catalog.
Federal Civilian Executive Branch (FCEB) agencies were instructed to secure their systems by the upcoming Friday, in compliance with Binding Operational Directive (BOD) 26-04.
“Such vulnerabilities are commonly exploited by malevolent cyber actors, presenting considerable risks to federal operations,” the agency cautioned.
While BOD 26-04 is primarily focused on US federal institutions, CISA has exhorted all network defenders, including their private sector counterparts, to prioritize the remediation of this vulnerability to safeguard their systems.
Although CISA has not disclosed specific details regarding the attackers exploiting CVE-2026-119977, Wordfence, a prominent WordPress security firm, reported over the weekend that it “thwarted 13,095 attacks targeting this vulnerability within a mere 24-hour period.”
Earlier in July, the WordPress security team addressed a critical vulnerability chain in WordPress Core, known as wp2shell, which could be misused to deploy web shells and commandeer unpatched servers by leveraging a REST API batch-route confusion issue (CVE-2026-63030) along with an SQL injection vulnerability (CVE-2026-60137).
Public exploitation for wp2shell emerged just one day after the patch release, which led to attackers breaching unpatched servers shortly thereafter to establish persistent web shells and implant malicious plugins.
A Chinese-speaking threat actor also weaponized the wp2shell exploit chain in September, pilfering sensitive information from over 18,500 records stored in backend databases belonging to small enterprises and governmental organizations.
Source link: Bleepingcomputer.com.
