CISA gives agencies until November 6 to patch WordPress

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, giving Federal Civilian Executive Branch agencies until November 6, 2026 to patch. The flaw is in WordPress Core itself, not a plugin, and it carries a CVSS score of 8.1.

It is a time-of-check time-of-use (TOCTOU) race condition in the full-package core upgrade process. When WordPress pulls down and unpacks a complete core update, it writes the new package to a staging path before moving it into place. CISA says those staging paths are predictable and web-accessible, and the installer’s setup-config.php is reachable there while the upgrade is in flight. An attacker who hits that path during the window gets unauthenticated code execution on the server.

TOCTOU bugs turn on the gap between when a program checks a condition and when it acts on it. Here the check is roughly “this is a legitimate, in-progress upgrade,” and the use is installer logic running out of the staging directory. Because the path is guessable and served over HTTP, an unauthenticated attacker can race the upgrade and reach installer code that was only ever meant to run for the site owner. No account on the target is needed. The constraint is timing: the opening exists only while a complete core update runs.

Wordfence published details last week and reported that exploiting the flaw requires catching that brief window during a complete core update. In the first 21 hours after disclosure it logged more than 18,500 requests aimed at staged setup-config.php installer paths, and it reports blocking 12,632 exploitation attempts in the most recent 24-hour period. Previdian recorded three exploitation attempts against its honeypot sensors from a single UK-geolocated IP address on October 30, 2026.

Patches shipped late last month, ahead of both the public write-up and the KEV listing. For most operators the fix is straightforward: get onto the patched core release. The awkward part is that the exposure sits inside the upgrade mechanism itself, so the act of running a full-package core update is where the window opens. Sites that auto-update are patching and exposing themselves in the same operation, which is why the attack volume clustered on installer paths immediately after disclosure.

If you run WordPress at any scale, confirm the patched core version is actually deployed rather than queued, and check that your edge or WAF is handling the fleet rather than relying on per-site auto-update timing. Block or restrict external access to upgrade staging paths and to setup-config.php outside a genuine install flow; there is no reason an internet client should be fetching an installer config during a routine upgrade. The request pattern Wordfence described, bursts of hits against staged setup-config.php paths, is a clean detection signal in access logs, so grep for it across the window around any recent core update.

The November 6 deadline is binding only on FCEB agencies, but with CISA confirming active exploitation and the attack traffic already in the tens of thousands of requests per day, it is a reasonable marker for everyone else running these systems.