The **US Cybersecurity and Infrastructure Security Agency (CISA)** has added a critical **WordPress** vulnerability, **CVE-2026-119977**, to its Known Exploited Vulnerabilities (KEV) Catalog, urging federal agencies to patch their systems by Friday. This alert comes as evidence mounts of active exploitation of the flaw in the wild. ### Understanding the Vulnerability **CVE-2026-119977** is a high-severity Time-of-check Time-of-use (TOCTOU) race condition flaw residing within **WordPress Core**. Discovered by **Picus Security** researcher **Umut Bayram**, the vulnerability can enable unprivileged remote threat actors to execute code on a server. This is primarily due to predictable, web-accessible staging paths utilized during full-package core upgrades. **WordPress** security teams addressed this issue with the release of **WordPress 7.1.4** on October 28. They emphasized the urgency, stating, "A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window... Because this is a security release, it is recommended that you update your sites immediately." ### CISA's Urgent Directive **CISA** confirmed active exploitation on Tuesday, mandating that Federal Civilian Executive Branch (FCEB) agencies secure their systems by Friday, in accordance with Binding Operational Directive (BOD) 26-04. The agency highlighted the gravity of the situation, noting, "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." While the directive specifically targets federal entities, **CISA** has extended its recommendation to all network defenders, including those in the private sector, to prioritize patching this vulnerability to safeguard their servers against potential attacks. ### Widespread Attack Attempts Though **CISA** has not disclosed specific details regarding the ongoing exploitation, **WordPress** security firm **Wordfence** reported a surge in malicious activity. An advisory update over the weekend indicated that **Wordfence** had "blocked 13,095 attacks targeting this vulnerability in the past 24 hours," underscoring the widespread attempts by threat actors to leverage **CVE-2026-119977**. ### A Pattern of Exploited WordPress Flaws This isn't an isolated incident for **WordPress**. In July, the security team patched a critical vulnerability chain dubbed **wp2shell**. This chain, comprising a REST API batch-route confusion vulnerability (**CVE-2026-63030**) and an SQL injection flaw (**CVE-2026-60137**), could be abused to deploy webshells and compromise unpatched servers. Public exploits for **wp2shell** emerged swiftly after patches were released, leading to immediate breaches of unpatched servers for the installation of persistent webshells and malicious plugins. Notably, a Chinese-speaking threat actor weaponized the **wp2shell** exploit chain in September, successfully stealing sensitive data from over 18,500 records belonging to small businesses and government organizations. The repeated exploitation of critical **WordPress** vulnerabilities serves as a crucial reminder for all organizations to maintain rigorous patching schedules and adhere to security best practices.