CISA has added CVE-2026-119977, a race-condition remote code execution flaw in WordPress Core, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The listing follows the WordPress 7.1.4 release that shipped in late October without a CVE identifier.
CISA Confirms Exploitation of the CVE-2026-119977 Upgrade Flaw
The flaw carries a CVSS score of 8.1 and affects WordPress Core versions 4.7 through 7.1.3 during full-package core upgrades. CISA describes it as a time-of-check time-of-use race condition. Unauthenticated attackers can execute code on the server during the upgrade window, because full-package core upgrades use predictable, web-accessible staging paths.
An attacker needs no account. The one requirement is timing: exploitation depends on hitting a short window while a site is in the middle of a full core update. The KEV listing triggers a mandatory remediation deadline for federal agencies.
Patched Releases Reach Back to WordPress 4.7
WordPress fixed the problem in version 7.1.4, released in late October, and backported the fix to branches going back to 4.7. Administrators running any affected release should move to 7.1.4 or later. The first warnings about attack attempts came from Wordfence around the time the release shipped, before the flaw had a CVE number.
Wordfence and Previdian Telemetry Show the Scale of Attempts
Wordfence recorded more than 18,500 requests targeting staged “setup-config.php” installer paths in the first 21 hours after disclosure. The firm has since blocked 12,632 attack attempts in the past 24 hours. Those figures count attempts, not confirmed compromises, and neither Wordfence nor CISA has said how many sites were successfully taken over.
Honeypot Logs Three Attempts From a U.K. Address
Separately, honeypot telemetry from Previdian logged three exploitation attempts from an IP address geolocated to the United Kingdom. The small number reflects what one honeypot saw, not the full extent of scanning, but it shows that the targeting of the staging paths is not limited to a single sensor or network.
Why Staging Paths Make This Race Condition Dangerous
The vulnerability sits in a routine administrative action. A full-package core upgrade writes files to locations the web server can reach, and the paths follow a predictable pattern. An attacker who knows the pattern can send requests aimed at those locations and try to place or trigger code while the upgrade is in progress. The window is brief, which limits how reliably any one attempt works, but automated scanning can repeat requests against large numbers of sites.
The exposure falls on sites that update from an affected release without the patch. WordPress powers a large share of the web, so the pool of potentially vulnerable installations is broad, including sites on old branches that still receive backported fixes.
The pattern in the telemetry is consistent with scanners probing for installer files at scale. Requests for setup-config.php paths are a recognizable signature, and site operators who review web logs can search for them. Because the attempt volume is high, a site is more likely to be probed than to be successfully compromised, but the outcome of a successful attempt is code execution on the server.
Federal Deadline and What Site Operators Need to Do
The KEV entry gives federal civilian agencies a fixed remediation date, and the catalog is widely used by private-sector teams as a priority list. Operators should confirm that every WordPress installation runs 7.1.4 or a backported equivalent for its branch, and should treat any unexplained files in installer or staging locations as a sign to investigate.
The sequence from this flaw is worth noting. A patch shipped first, attack attempts followed within hours, and the CVE and KEV listing arrived days later. For sites that delayed the update after the October release, the gap between patch and confirmed exploitation has now closed.
