WordPress Core Upgrade Flaw Hits CISA KEV, Due Nov 6

Patch first. If a WordPress site you run has not taken the core release from late October, update it today. CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog, and The Hacker News reports that federal civilian agencies have until November 6, 2026 to apply the fix.

What changed

The flaw is a time-of-check time-of-use (TOCTOU) race condition in WordPress Core. A TOCTOU bug happens when software checks a condition and then acts on it, and an attacker slips in between the two steps. The Hacker News gives it a CVSS score of 8.1 (high).

CISA says unauthenticated attackers could execute code on the server during the upgrade window. It blames predictable, web-accessible staging paths used in full-package core upgrades.

No account on the site is needed. According to the same report, Wordfence said the attacker only has to hit the short window while a complete core update is running.

Exploitation status

CISA’s listing is the confirmation. The Hacker News also relays Wordfence telemetry: more than 18,500 requests aimed at staged installer paths in the first 21 hours after public disclosure, and 12,632 blocked attempts in the 24 hours before publication. It adds that Previdian honeypots logged three attempts on October 30, 2026, from a U.K.-geolocated address. These are vendor-reported numbers, not independent counts.

What to do

1. Update WordPress Core to the patched release issued late October. Don’t wait for a maintenance window.
2. Federal civilian agencies: the KEV due date is November 6.
3. Everyone else: treat the KEV listing as the signal to move this above routine plugin updates.
4. If you run a WAF or a managed WordPress security service, confirm it covers requests to installer and staging paths. It does not replace the update.
5. Review web server logs for unexpected requests to installer files, such as setup-config.php, around past upgrade times.

Priority call

Plugin bugs have dominated WordPress news this month, including the PHP2Shell KEV deadline and a run of exploited plugin flaws. This one is in Core, so it reaches sites regardless of which plugins they run. Core first, then plugins.

See the WordPress hub for related coverage.