{"id":3960,"date":"2026-11-04T08:13:40","date_gmt":"2026-11-04T08:13:40","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3960"},"modified":"2026-11-04T08:13:40","modified_gmt":"2026-11-04T08:13:40","slug":"cisa-confirms-hackers-exploiting-wordpress-core-flaw-during-software-upgrades","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3960","title":{"rendered":"CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 04, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added<\/a> a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV<\/a>) catalog, citing evidence of active exploitation.<\/p>\n

The high-severity vulnerability, tracked as CVE-2026-119977<\/a><\/strong> (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers. Patches for the flaw were released<\/a> late last month.<\/p>\n

\u00abWordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window,\u00bb CISA said. \u00abThis is due to predictable, web-accessible staging paths used during full-package core upgrades.\u00bb<\/p>\n

Details of the flaw emerged last week when Wordfence said exploiting the vulnerability does not require an account on the site. That said, it does require an attacker to exploit a brief window during a complete Core update that could allow unauthenticated code execution.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

During the first 21 hours after public disclosure, the WordPress security company said it recorded more than 18,500 requests targeting staged \u00absetup-config.php\u00bb installer paths. As of writing, 12,632 attacks<\/a> attempting to exploit the flaw have been blocked in the last 24 hours.<\/p>\n

Telemetry data from Previdian shows<\/a> that three exploitation attempts have been recorded against its honeypot censors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026.<\/p>\n

With exploitation now officially confirmed by CISA, Federal Civilian Executive Branch (FCEB) agencies have time until November 6, 2026, to apply the fixes.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Nov 04, 2026Vulnerability \/ Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog,…<\/p>\n","protected":false},"author":1,"featured_media":3961,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[62,63,1350,653,70,338,588,4042,1927],"class_list":["post-3960","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-cisa","tag-confirms","tag-core","tag-exploiting","tag-flaw","tag-hackers","tag-software","tag-upgrades","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3960"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3960\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3961"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}