WordPress Core Vulnerability Triggers Widespread Automated Exploitation Attempts
A critical race condition in WordPress updates is being actively exploited by attackers.
1Critical Race Condition Identified
WordPress versions 4.7 through 7.1.3 contain a high-severity vulnerability, tracked as CVE-2026-119977. This flaw, carrying a CVSS score of 8.1, involves a time-of-check time-of-use race condition. It allows unauthenticated attackers to execute arbitrary code on servers during the specific, narrow window when WordPress unpacks a full-package core update.
2Predictable Staging Path Risks
The security flaw stems from the use of predictable, web-accessible staging paths during the update process. Files are unpacked into a directory under 'wp-content/upgrade', which includes the WordPress installer. Because this directory is accessible via the web, attackers can interact with the staged files before the update completes.
3Active Exploitation Campaigns Detected
Threat actors are actively polling vulnerable paths like 'setup-config.php' to trigger the flaw. One security firm reported blocking over 62,969 attacks within a 24-hour period. Attackers have demonstrated sophisticated behavior, using sustained polling and various directory name variations to successfully catch the brief, seconds-long window required for exploitation.
4CISA Adds to KEV
On November 3, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added this vulnerability to its Known Exploited Vulnerabilities catalog. CISA confirmed that evidence of active exploitation exists, necessitating urgent action. Federal Civilian Executive Branch agencies are now mandated to apply the necessary patches by November 6, 2026.
5Honeypot Telemetry Data
Evidence of the threat extends beyond general traffic monitoring. Telemetry from Previdian honeypot sensors recorded three specific exploitation attempts originating from an IP address geolocated in the United Kingdom. These events were observed on October 30, 2026, confirming that attackers are actively targeting vulnerable installations across different global network environments.
6Immediate Remediation Steps
WordPress site administrators are urged to update their installations to version 7.1.4 immediately to close the security gap. Beyond patching, owners should conduct thorough audits of their environments. This includes checking for suspicious PHP files within the 'wp-content/upgrade' directory, unauthorized administrator accounts, or any unfamiliar plugins installed on the site.
7Understanding Race Conditions
A race condition occurs when a system's behavior depends on the sequence or timing of uncontrollable events. In this case, the vulnerability exists because the software assumes the update process is private. Attackers exploit this by timing their requests to interact with the installer files before the system secures them.
8Broader Security Implications
This incident highlights the risks associated with automated update mechanisms in widely used content management systems. While CISA confirms active exploitation, not every vulnerable site is necessarily compromised. However, the ability to achieve code execution without authentication makes this a high-priority threat that requires immediate attention from all administrators.