WordPress RCE flaw now exploited in the wild

A high-severity flaw in WordPress Core has moved from patched to actively attacked. The US Cybersecurity and Infrastructure Security Agency confirmed that attackers are exploiting CVE-2026-119977 in the wild, and on Tuesday added it to the Known Exploited Vulnerabilities (KEV) Catalog.

The vulnerability lives in the WordPress upgrade process, not in a plugin or theme. It was reported by Picus Security researcher Umut Bayram and stems from a Time-of-check Time-of-use (TOCTOU) race condition. The WordPress security team shipped a fix in WordPress 7.1.4 on October 28.

A race in the upgrade path

CVE-2026-119977 is tied to the full-package core upgrade process. During that operation, WordPress uses predictable, web-accessible staging paths. The TOCTOU race condition arises from the gap between the moment the system checks a resource and the moment it uses it, and in this case the result can be remote code execution.

The WordPress security team described the problem plainly when it released 7.1.4.

"A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window."

— the WordPress security team, in its October 28 release of WordPress 7.1.4

The same notice carried a direct instruction to site operators.

"Because this is a security release, it is recommended that you update your sites immediately."

— the WordPress security team, in its October 28 release of WordPress 7.1.4

No privileges required

Successful exploitation lets remote threat actors without privileges execute code on the server. The source material describes this as a high-complexity attack, a label that reflects the precision required to hit the race condition rather than the amount of access an attacker needs beforehand.

The staging paths involved are web-accessible, which places the attack surface on the network rather than behind an administrative login. An unauthenticated attacker is thus working against the upgrade window itself, and the fix shipped in 7.1.4 targets that process.

Federal deadline lands Friday

CISA's KEV listing carries a binding requirement for Federal Civilian Executive Branch agencies, which must secure their systems by Friday under Binding Operational Directive (BOD) 26-04. The agency framed the risk in familiar terms.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise."

— CISA

BOD 26-04 applies only to US federal agencies, but CISA urged all network defenders, including those in the private sector, to prioritize patching this vulnerability to protect their servers.

What Wordfence is seeing

CISA did not provide more details on attackers exploiting CVE-2026-119977 in the wild. WordPress security firm Wordfence supplied a concrete figure in an advisory update over the weekend, saying it "blocked 13,095 attacks targeting this vulnerability in the past 24 hours."

That number offers a window into volume. It is a count of blocked attempts observed by one security vendor, not a measure of successful compromises, and it does not identify who is behind the traffic.

The wp2shell precedent

CVE-2026-119977 is not the first WordPress Core issue to draw exploitation this year. In July, the WordPress security team patched a critical vulnerability chain in WordPress Core named wp2shell. That chain combined a REST API batch-route confusion vulnerability tracked as CVE-2026-63030 with an SQL injection flaw tracked as CVE-2026-60137, and it could be abused to deploy webshells and take over unpatched servers.

Public wp2shell exploits were released one day after the patches went live. Attackers began breaching unpatched servers a few days later to deploy persistent webshells and install malicious plugins.

A Chinese-speaking threat actor also weaponized the wp2shell exploit chain in September to steal sensitive data from more than 18,500 records stored in backend databases belonging to small businesses and government organizations.

The numbers behind the alert

• CVE-2026-119977 — the WordPress Core flaw added to CISA's KEV Catalog after confirmed exploitation.
• October 28 — the date WordPress 7.1.4 was released with patches for the vulnerability.
• Friday — the deadline for Federal Civilian Executive Branch agencies to secure systems under BOD 26-04.
• 13,095 attacks — the volume Wordfence said it blocked targeting the vulnerability in the past 24 hours, per its weekend advisory update.
• 18,500 records — the approximate volume of data stolen from backend databases in the September wp2shell campaign attributed to a Chinese-speaking threat actor.
• CVE-2026-63030 and CVE-2026-60137 — the REST API batch-route confusion flaw and SQL injection flaw that made up the July wp2shell chain.

Who is exposed right now

Any WordPress installation that has not moved to 7.1.4 remains on the wrong side of the patch line. The vulnerability sits in core, so site owners cannot address it by disabling a plugin or switching themes; the upgrade itself is the remediation.

The flaw is specific to the full-package core upgrade process, a routine operation for many administrators. CISA's decision to list the vulnerability reflects confirmed exploitation rather than theoretical risk, and the agency's guidance to private-sector defenders is the same as its instruction to federal agencies: prioritize patching.

The wp2shell episode shows what can follow an unpatched WordPress Core flaw once exploitation begins. That chain ended in webshells, malicious plugins, and a data theft campaign spanning thousands of records from small businesses and government organizations.

What the listing changes

CISA's KEV entry gives federal civilian agencies a hard deadline of Friday under BOD 26-04. For organizations outside the federal civilian branch, the listing is advisory, but it rests on confirmation of active exploitation rather than on the severity score alone.

The WordPress security team's October 28 message was already explicit that 7.1.4 should be applied immediately. CISA's Tuesday confirmation, followed by the KEV addition, gives that recommendation additional weight: the vulnerability is not merely patched and waiting, it is being used.

Wordfence's blocked-attack count of 13,095 in a 24-hour period, reported over the weekend, describes ongoing activity against the flaw. Site operators who have not yet updated are working against both a published patch and a live exploitation campaign.