WordPress Core Vulnerability CVE-2026-119977 Exploited During Upgrades

What Happened

CISA has added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw, CVE-2026-119977, is a high-severity Time-of-check Time-of-use (TOCTOU) race condition with a CVSS score of 8.1. CISA says attackers are exploiting it during software upgrades, and the vulnerability could allow an attacker to achieve arbitrary code. BleepingComputer reports that CISA warned federal agencies that attackers have started exploiting the recently patched flaw in the wild.

For MSPs, this is not a niche issue. WordPress Core is the foundation of a large share of client websites, and the upgrade process is something most MSPs run regularly. A flaw that is exploitable during upgrades means the moment you think you're securing a site, an attacker may be using that same moment to break in. That makes patch management and verification the immediate priority.

The KEV catalog is CISA's list of known exploited vulnerabilities. When CISA adds a CVE there, it's a signal that the threat is real and current, not theoretical. For MSPs, a KEV listing is a useful prioritization signal because it means attackers have already built working exploits.

Timeline

No timeline has been published yet. The sources do not state when the vulnerability was discovered, when the patch was released, or when active exploitation first started.

Who Is Affected

Any WordPress Core installation that has not applied the available patch is potentially at risk. The sources identify WordPress Core as the affected product and do not list specific versions. Because the vulnerability is triggered during software upgrades, sites are most exposed at the moment an update is being applied. That includes managed sites where an MSP runs updates on behalf of the client, as well as client sites that update themselves. If you support WordPress for clients, you should assume some of them could be exposed until you confirm otherwise.

Technical Details: WordPress Core Vulnerability

CVE-2026-119977 is a high-severity vulnerability in WordPress Core with a CVSS score of 8.1. It is a Time-of-check Time-of-use (TOCTOU) race condition. Per the sources, it could be exploited to achieve arbitrary code. CISA added it to the KEV catalog citing evidence of active exploitation, and reporting says it is being actively exploited during software upgrades. The sources do not list affected versions or an attack vector beyond the upgrade process.

A TOCTOU race condition happens when software checks a condition and then uses the result later, but the state changes in between. In an upgrade routine, that gap can let an attacker swap a file or alter a step after it has been checked but before it is used. The result in this case is the possibility of arbitrary code execution, which is about as serious as a web vulnerability gets.

Why This Matters for MSPs

A WordPress Core vulnerability is different from a plugin flaw because it affects the base of the site. When the core is compromised, an attacker may be able to do anything the web server user can do, which often includes reading configuration files, accessing the database, and modifying site files. For an MSP, that means a single compromised WordPress site can become a foothold into client infrastructure, depending on how the site is hosted and what it connects to.

Upgrade time matters here. Updates are one of the few moments when a site is changing rapidly, and the sources say this flaw is being exploited during software upgrades. That is a reminder to treat updates as a security event, not just a maintenance task. It also means the usual advice to patch quickly is not enough. You need to verify that the patch process itself did not leave a door open.

What to Do This Week

The sources do not include vendor instructions, so the steps below are the standard ones for any actively exploited WordPress Core flaw.

1. Apply the latest WordPress Core security release to every site you manage, including staging and test environments.
2. Review recent WordPress Core upgrades. Confirm each one finished cleanly and that no unexpected files, plugins, themes, or admin users appeared.
3. Check authentication and error logs for signs of tampering around upgrade times, such as failed logins, unusual admin activity, or file changes outside the normal update process.
4. Rotate WordPress admin passwords and database credentials as a precaution, especially for any site where an upgrade ran recently.
5. Verify backups are current and that you can restore a site quickly. Test the restore process if you have not done so recently.
6. Keep an eye on CISA's KEV catalog. If the agency adds more CVEs, treat them with the same urgency.

What to Tell Clients

A vulnerability was disclosed in WordPress Core that attackers are actively exploiting. It is serious because it can let an attacker run code on the site during an update. We are applying the security update to all managed sites and reviewing recent upgrades for signs of compromise.

If you have a WordPress site that we do not manage, update WordPress Core as soon as possible. After the update, check for anything unexpected, including new admin users, unknown plugins, or modified files. If you're not sure how to do that, we can help.

We will confirm that each site we manage is patched and clean. If you see any suspicious activity on your site, tell us right away.

Frequently Asked Questions

Sources

• CISA Confirms Hackers Exploiting WordPress Core Flaw During Software UpgradesHackernews · Reported
• CISA flags WordPress RCE flaw as actively exploited in attacksBleepingcomputer · Reported
• Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last TimeHackernews · Reported