Follow us on Google News
The United States Cybersecurity and Infrastructure Security Agency has confirmed that malicious actors are actively exploiting a high-severity vulnerability in WordPress Core, prompting federal authorities to order immediate security remediation across government networks. The flaw, designated as CVE-2026-119977 with a CVSS score of 8.1, allows remote attackers to execute arbitrary code on targeted web servers without requiring prior authentication or valid user credentials. Following real-world exploitation in active attacks, the agency added the security weakness to its Known Exploited Vulnerabilities catalogue, moving the flaw beyond theoretical risk and accelerating remediation timelines for website operators worldwide.
Software Update Process Exposes Temporary Installation Paths
The vulnerability stems from predictable staging paths that remain accessible through the web during complete, full-package WordPress Core updates. Classified as a time-of-check time-of-use race condition, the security issue emerges when a system verifies a resource and subsequently executes it after an interval, leaving a fleeting window during which external actors can manipulate setup files. Security researchers at Wordfence publicly detailed the mechanism last week, confirming that attackers do not need compromised accounts, administrator access, or an active session to target the software.
Because the vulnerability manifests during a routine maintenance task, organizations face significant risk during the exact window when they attempt to update their installations. While the exploitation window remains restricted to the active duration of a complete Core upgrade, the absence of an authentication requirement makes exposed installations highly susceptible. CISA pointed out that predictable staging pathways permit attackers to interfere with temporary setup components, enabling unauthorized command execution directly on underlying host servers without overcoming credential barriers.
Telemetry Documents Thousands of Automated Probes
Cybersecurity monitoring networks observed immediate, aggressive scanning targeting the flaw within hours of its public disclosure. Wordfence reported more than 18,500 requests probing staged “setup-config.php” installer pathways during the first 21 hours following publication, illustrating the rapid speed at which threat actors weaponized the disclosure. Ongoing defensive telemetry revealed that 12,632 attack attempts seeking to trigger the vulnerability were blocked over a single 24-hour observation period, showing persistent attempts to identify installations undergoing maintenance.
Independent telemetry gathered by cybersecurity firm Previdian confirmed additional malicious activity. Previdian recorded three targeted attempts against its honeypot detection sensors originating from an Internet Protocol address geolocated in the United Kingdom on October 30, 2026. While localized, the honeypot captures reinforce findings that international threat actors are actively seeking out unpatched environments. The observed traffic underscores the speed with which unauthenticated vulnerabilities attract widespread scanning campaigns across the broader internet ecosystem.
Federal Directives Mandate Swift Patching by November 6
In response to active exploitation, CISA issued a binding directive requiring Federal Civilian Executive Branch agencies to remediate CVE-2026-119977 by November 6, 2026. Security patches designed to eliminate the race condition and secure staging directories were published late last month. System administrators are being urged to verify that all deployed instances have incorporated the latest fixes, as traditional access restrictions and strict login controls provide no protection against exploits targeting the upgrade sequence itself.
Security specialists advise administrators to supervise temporary installation directories and close web-accessible staging locations during maintenance routines. The entry of the flaw into the federal Known Exploited Vulnerabilities catalogue establishes a mandatory compliance window for federal agencies while signaling critical danger for private enterprises running WordPress Core. With thousands of unauthorized attempts already intercepted, applying the published patches remains the definitive measure to halt unauthorized code execution.
