The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies regarding the detection of active exploitation of a high-severity vulnerability in the WordPress content management system. The vulnerability, identified as CVE-2026-119977, falls under the category of "Remote Code Execution" (RCE), granting attackers the ability to take control of targeted servers.
This vulnerability arises from a technical flaw known as a "Time-of-check Time-of-use" (TOCTOU) race condition within the WordPress Core update process. Attackers exploit temporary paths accessible via the web during the full system package upgrade process, allowing them to execute malicious code in a highly complex environment.
Official actions and escalation of attacks
Based on this threat, CISA has added the vulnerability to its "Known Exploited Vulnerabilities" (KEV) catalog and issued a binding directive (BOD 26-04) requiring federal civilian agencies to secure their systems no later than next Friday. Although this order is binding only for U.S. government entities, the agency has urged network administrators in the private sector globally to prioritize updating their systems immediately.
Field data indicates the escalating scale of the attack; the security firm Wordfence reported that it managed to block more than 13,095 attacks targeting this vulnerability within just 24 hours of detecting the activity.
What changes practically?
The real danger of this vulnerability lies in its ability to bypass traditional security barriers; attackers can execute commands without needing any prior accounts or access privileges on the site. Furthermore, exploiting the "update window" makes it difficult to detect suspicious activity because it occurs during a routine system maintenance process.
This threat comes in the context of a wave of vulnerabilities that have recently targeted WordPress, such as the wp2shell series of vulnerabilities exploited last September to steal data from more than 18,500 records belonging to small businesses and government organizations. To avoid these risks, all site administrators must upgrade immediately to WordPress 7.1.4 or any later version that includes the security patches.