CISA Confirms Active Exploitation of WordPress Core TOCTOU Vulnerability
Critical race condition flaw allows unauthenticated code execution during WordPress software upgrade windows.
1Critical WordPress Core Vulnerability
CISA has officially added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. This high-severity flaw, carrying a CVSS score of 8.1, involves a Time-of-check Time-of-use race condition within WordPress Core. It enables unauthenticated attackers to execute arbitrary code on affected servers specifically during the brief window when a full-package core update is being processed.
2Exploitation Mechanism Explained
The vulnerability stems from the use of predictable, web-accessible staging paths during the WordPress upgrade process. Because these paths are reachable, attackers can intercept the update sequence. Wordfence confirmed that exploitation does not require any existing user account on the target site, making it a significant risk for any site currently undergoing maintenance.
3High Volume of Attacks
Security telemetry reveals intense interest from malicious actors. Within the first 21 hours following public disclosure, over 18,500 requests targeted the setup-config.php installer paths. Furthermore, in the most recent 24-hour period, security systems successfully blocked 12,632 distinct attempts to exploit this specific flaw, demonstrating that automated scanning for this vulnerability is currently widespread.
4Observed Honeypot Activity
Data from Previdian honeypot sensors provides concrete evidence of active targeting. On October 30, 2026, three separate exploitation attempts were recorded against their systems. These specific attacks originated from an IP address geolocated within the United Kingdom, confirming that the threat is global and not limited to any single geographic region or specific network.
5Mandatory Federal Compliance
Following the official confirmation of active exploitation by CISA, strict remediation timelines are now in effect. Federal Civilian Executive Branch agencies are legally required to apply the necessary patches to their WordPress installations by November 6, 2026. This directive highlights the severity of the risk posed to government-managed web infrastructure and public-facing digital assets.
6Patch Availability Status
Patches addressing this race condition were released by the WordPress development team late last month. Administrators are urged to verify their current version and ensure that the update process is completed immediately. Given the predictable nature of the staging paths, delaying the application of these fixes leaves servers exposed to unauthorized remote code execution.
7Operational Security Risks
The nature of this flaw creates a unique security challenge because it is tied to the update mechanism itself. Organizations must balance the need for regular software maintenance with the risk of exposing staging paths. Security teams should monitor server logs for unusual requests targeting setup-config.php during any scheduled maintenance or core update operations.
8Broader Threat Landscape Implications
This incident underscores the importance of securing temporary files and staging directories during software deployment. As attackers increasingly target the update lifecycle, developers must prioritize non-predictable path generation. Moving forward, organizations should integrate automated vulnerability scanning into their CI/CD pipelines to detect such flaws before they are disclosed and actively exploited in the wild.