CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code

The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious code to run on website servers.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming evidence of active exploitation and raising the need for prompt patching.

Tracked as CVE-2026-119977, the vulnerability affects WordPress Core versions 4.7 through 7.1.3 and carries a high severity CVSS score of 8.1. Attackers do not need a valid account or user interaction. However, exploitation requires precise timing during a full WordPress Core upgrade, rather than simply visiting any website running an affected version.

The weakness involves predictable temporary folders created during updates. When WordPress extracts a complete upgrade package, it places files in a staging directory beneath wp-content/upgrade. On affected setups, those files can be reached through the web while the server is still completing the update, briefly exposing a separate copy of the WordPress installer.

An attacker who reaches that installer before cleanup finishes could use it to connect the staged installation to a database they control, creating a path toward server code execution. This is a time-of-check, time-of-use race condition, commonly called TOCTOU. The attack depends on reaching temporary files before WordPress removes them.

The brief opening does not make the flaw harmless. Cybersecuritynews.com’s report on WordPress remote code execution attacks described more than 18,500 requests targeting staged installer paths during the first 21 hours of monitoring. Repeated requests can help attackers catch the short upgrade window, although those requests alone do not prove a successful breach.

WordPress Core Vulnerability Exploited

The official CISA alert confirms exploitation but does not identify the attackers or disclose how many websites were compromised. Its catalog entry gives defenders a stronger reason to prioritize the issue beyond its severity score. CISA also urges organizations outside government to address known exploited vulnerabilities through risk-based patching.

A separate Cybersecuritynews.com report covering more than 60,000 WordPress attack attempts cited 60,471 blocked attempts over 24 hours. That figure measures firewall activity, not unique victims or confirmed infections. Keeping these categories separate is important when judging the scale of a campaign and explaining what monitoring data actually shows.

WordPress released version 7.1.4 on October 28, 2026, to fix the upgrade weakness and other security issues. The official security announcement credits researcher Umut Bayram with reporting the flaw and recommends immediate updates. WordPress also announced backports for eligible older branches, while noting that only its latest release remains actively supported.

Administrators should open the Dashboard, select Updates, and verify that the security release has finished installing. Sites relying on automatic background updates still need that check. Until patching is complete, restricting public web access to the upgrade directory can reduce exposure. A firewall should remain an extra layer of protection, not a replacement for fixing WordPress Core.

Defenders should review server logs for unusual requests to PHP files under wp-content/upgrade and investigate unfamiliar administrator accounts, plugins, or file changes. These checks help identify signs that need further investigation, without treating every blocked request as proof of compromise.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.