The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that attackers are exploiting a flaw in WordPress's core software that can let them run code on a website's server while the site updates itself. Because WordPress runs many corporate, campaign and government websites, the listing turns a routine patch into a deadline: federal civilian agencies must fix the flaw by Friday, Nov. 6, and CISA urged every organization to prioritize it.
What Happened
In an alert, CISA added the flaw, tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities catalog, a list of bugs with evidence of real-world attacks. CISA did not describe the attacks, and its catalog entry lists use by ransomware groups as unknown.
The bug is a race condition, a timing flaw in which an attacker acts in the gap between a system checking something and using it. During a full-package core update, WordPress unpacks new files into a temporary staging folder whose location is predictable and, on many servers, reachable from the web. An attacker who reaches that folder in the brief window can run code on the server without any account on the site, according to CISA's catalog entry. SecurityWeek, citing Wordfence maker Defiant, said the attack complexity is high.
WordPress fixed the flaw in version 7.1.4 on Oct. 28, crediting researcher Umut Bayram, and released fixed versions for every older branch back to 4.7. The release announcement lists 12 vulnerability fixes in all, most of them cross-site scripting bugs. According to SecurityWeek, the fix randomizes the staging folder's location and blocks unsafe use of staged configuration data.
Wordfence, a company that sells WordPress firewall software, logged more than 18,500 requests aimed at the staging paths in the first 21 hours after its blocking rule went live, SecurityWeek reported, though the firm has not reported confirmed break-ins.
Why It Matters
Flaws in WordPress itself, rather than in add-on plugins, reach every site running an affected version. Sites with automatic background updates should already have the fix, according to WordPress. The exposure sits with organizations that switched automatic updates off, sites that apply updates by hand through agencies or contractors, and sites on versions 4.6 and older, which receive no security updates.
CISA's catalog entry also requires forensic triage under Binding Operational Directive 26-04, meaning agencies must check whether attackers got in before the patch, not just install it. Private site owners can apply the same standard: confirm the installed version, review web server logs for repeated requests to the temporary folders WordPress uses during updates, and look for files on the server that nobody on staff created.
Context
This is not the first WordPress flaw this fall to draw attacks quickly. The Primary Wire reported in September, citing security firm Patchstack, that attackers began exploiting a separate WordPress flaw almost immediately after it was disclosed.
What to Watch
The Nov. 6 federal deadline, and whether CISA, WordPress or security firms publish evidence of successful compromises. So far neither CISA nor Wordfence has said how many sites, if any, were taken over.
