- CISA added WordPress Core flaw CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on evidence of active exploitation. The Hacker News reports patches came out late last month.
- The flaw opens only during a full-package core upgrade, so the maintenance window is the exposure window.
- Confirm which sites have applied the patch, and check for signs of compromise from before it.
Updating software is meant to be the safe act. A new federal alert shows the update itself can be the opening.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed CVE-2026-119977 in its Known Exploited Vulnerabilities (KEV) catalog. The flaw is in WordPress Core. CISA says it has evidence of active exploitation. The Hacker News reports that patches came out late last month.
How the flaw works
CISA classes the flaw as a race condition of the "time-of-check time-of-use" kind. In plain terms, a system confirms that something is safe and acts on it a moment later. An attacker who gets in between those two steps wins.
Think of a hotel that swaps its door locks while the old doors stand propped open. Nothing is wrong with the new locks. The danger is the stretch between old and new.
In WordPress, CISA says the weakness lets attackers with no login run code on the server while an upgrade is under way. It traces this to staging paths that are easy to predict and reachable from the web. Those paths are used only during full-package core upgrades. Staging paths are the temporary locations where update files wait before they replace the live ones.
Wordfence, the WordPress security company, said an attacker needs no account on the site. The attacker does need to reach the site during the brief window of a complete Core update. The Hacker News rates the flaw 8.1 on the CVSS severity scale.
What the early attack traffic shows
Wordfence said it logged over 18,500 requests in the 21 hours after public disclosure. They aimed at staged "setup-config.php" installer paths. The Hacker News adds that Wordfence has blocked 12,632 attempts in the latest 24 hours.
These are attempts, not confirmed break-ins. The reports do not say how many sites were compromised. They also do not say whether the requests came from targeted attackers or broad scanning.
Previdian, a security firm, reported three exploitation attempts against its honeypot sensors on October 30, 2026. A honeypot is a decoy system built to attract attackers. The attempts came from an IP address geolocated in the U.K. That date marks only when those first attempts were seen. The sources give no start date for the vulnerable period.
The lesson: a maintenance window is an exposure window
Most security planning treats patching as the cure. This flaw shows the cure has a risky moment of its own. An attacker has to reach a site during that brief window, and the staging paths are predictable.
That changes who carries the risk. It falls on whoever runs the upgrade, which for many organisations may be a small team or an agency. Their job is to apply the fix. For a flaw like this, the upgrade itself could be the moment an attacker is positioned to act. The sources do not say whether applying this particular patch is exposed.
Scale matters here, with a caveat. In WebPulse's September 2026 scan of the Tranco top 10,000 domains, 7,064 responded. A platform was detected on 2,491 of them, and WordPress on 719, or 28.9% of those. That is a sample of large sites, not the web. It does not show which of them are exposed. It does show that WordPress upgrades are routine work for a large share of detected sites.
What CISA's directive does and does not cover
The Hacker News gives November 6, 2026 as the deadline for federal civilian agencies. It comes from Binding Operational Directive 26-04, which covers only Federal Civilian Executive Branch agencies. It is not a standard for everyone else.
CISA still urges every organization to manage vulnerabilities by risk and to put KEV-listed flaws first. The directive also sets basic expectations for checking whether attackers compromised a system before the patch was applied. That second step is easy to skip once the update succeeds.
Questions to put to your team
First, which of our WordPress sites have applied the patch released late last month, and who confirmed it? Ask for a list, not an assurance.
Second, did any of those sites run a full core upgrade before the patch was applied? If so, has anyone checked for signs of compromise from before the fix, as CISA's directive expects of federal agencies?
Third, do the same people who run our upgrades also see our server logs? Requests for setup-config.php paths are the kind of traffic Wordfence reported.
Fourth, who manages sites on our behalf, such as agencies or hosts, and have they answered the first three questions in writing?
The patch closes this flaw. For this flaw, the system is most exposed while its owners are changing it. Plan upgrades with that in mind.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: U.S. Cybersecurity and Infrastructure Security Agency (CISA).
