CISA flags WordPress RCE flaw as actively exploited in attacks

CISA has added a WordPress Core vulnerability, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog after confirming active attacks against unpatched sites. The flaw is a time-of-check/time-of-use race condition in the full-package core upgrade process, discovered by Picus Security researcher Umut Bayram, that lets unauthenticated attackers achieve remote code execution by targeting predictable staging paths exposed during updates. WordPress fixed the issue with the release of version 7.1.4 on October 28, and security firm Wordfence reports it blocked over 13,000 exploitation attempts in a single day. Under Binding Operational Directive 26-04, federal agencies must remediate by Friday, but CISA is urging all WordPress site operators to update immediately given the real-world attack activity.