Vulnerabilities

CISA Confirms Active Exploitation of WordPress Core Race Condition Vulnerability

A TOCTOU flaw in WordPress Core’s upgrade process allows unauthenticated remote code execution, and attackers are already taking advantage of it.

AI-generated illustration depicting vulnerability for the story: CISA Confirms Active Exploitation of WordPress Core Race Condition Vulnerability

Summary

  • CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild.
  • The vulnerability is a time-of-check time-of-use (TOCTOU) race condition triggered during WordPress core upgrades, exploitable without authentication.
  • The flaw stems from predictable, web-accessible staging paths used during full-package core update installations.
  • Federal agencies subject to BOD 26-04 must apply vendor mitigations or discontinue use by 6 November 2026.
  • Organisations running WordPress at scale — including those using managed hosting — should treat this as a priority patching event.

What Has Been Confirmed

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on 3 November 2026, confirming that the vulnerability is being actively exploited. The flaw affects WordPress Core and is classified as a time-of-check time-of-use (TOCTOU) race condition. CISA’s addition to the KEV catalogue is not theoretical — it reflects evidence of exploitation observed in real environments.

How the Vulnerability Works

The root cause is straightforward and, once understood, illustrates why the risk is significant. During a full-package WordPress core upgrade, the platform stages files in paths that are both predictable and accessible via the web. An unauthenticated attacker who can anticipate or observe this staging window has an opportunity to interfere with the upgrade process and execute arbitrary code on the server.

Why Unauthenticated Exploitation Raises the Stakes

The absence of an authentication requirement substantially widens the attack surface. Any WordPress installation that is internet-facing and in the process of running a core upgrade becomes a potential target during that window. This is not a vulnerability that requires a compromised account, stolen credentials, or a privileged position inside the network. A remote, unauthenticated attacker with knowledge of the timing and path structure is sufficient.

The Upgrade Window Problem

TOCTOU vulnerabilities are particularly difficult to reason about in production environments because the exposure is transient — it exists only during a specific operation. That transience can create a false sense of security: administrators may assume that because upgrades are brief, the window is too narrow to exploit reliably. In practice, automated tooling can target these windows at scale, and predictable staging paths remove much of the uncertainty an attacker would otherwise face.

Scope and Affected Environments

The vulnerability affects WordPress Core itself, meaning the exposure is not limited to a specific plugin or theme. Organisations running WordPress for public-facing websites, intranets, or digital publishing platforms should assess their exposure regardless of hosting model. The source material notes that stakeholders are responsible for evaluating each asset’s internet exposure and aligning remediation to BOD 26-04 patching guidelines. For cloud-hosted environments, specific BOD 26-04 guidance applies.

Regulatory and Compliance Obligations

For Australian government agencies with obligations aligned to comparable frameworks, and for any organisation operating in sectors with regulatory patching requirements, the KEV listing and BOD 26-04 directive provide a useful benchmark. The mandated due date for US federal agencies is 6 November 2026. CISA has also flagged forensic triage requirements, suggesting that where exploitation may have already occurred, incident response steps — not just patching — are warranted.

Why it matters

WordPress powers a substantial portion of the world’s web infrastructure, including many enterprise content management environments. A remotely exploitable, unauthenticated code execution vulnerability in WordPress Core — one that is already being actively exploited — represents a credible and immediate risk to any organisation running an internet-facing WordPress instance. CISOs should be particularly attentive to environments where WordPress upgrades are automated or scheduled, as those systems will pass through the vulnerable window without manual oversight. The forensic triage requirement flagged by CISA also signals that for some organisations, the question is not just whether to patch, but whether they have already been compromised.

What to do now

  • Apply WordPress Core patches in accordance with vendor instructions as a matter of priority, treating the KEV listing as confirmation of active exploitation.
  • Inventory all internet-facing WordPress installations across your environment, including those managed by third parties or hosted on cloud platforms.
  • Review whether automated core update processes expose systems to the vulnerable upgrade window and assess whether additional controls are warranted during that period.
  • Follow CISA’s forensic triage requirements for any WordPress instances that may have been exposed prior to patching, particularly those that are internet-accessible.
  • For environments where mitigations cannot be applied, follow BOD 26-04 guidance, which may require discontinuing use of the product until a fix is available.
  • Align patching timelines to the 6 November 2026 deadline at minimum, and accelerate remediation given confirmed active exploitation.

Sources

Related Posts