The US Cybersecurity and Infrastructure Security Agency has warned that attackers are actively exploiting a high-severity flaw in WordPress Core that can let unauthenticated attackers run code on affected websites.

The flaw, tracked as CVE-2026-119977, is a time-of-check time-of-use race condition in the way WordPress carries out a full-package core update. During the update window, an attacker can replace a site's live wp-config.php configuration file with a malicious one, giving them control of the server. No login is needed to attempt the attack.

WordPress fixed the flaw in version 7.1.4, released on 28 October, with the fix backported to every maintained branch down to version 4.7. Sites running versions 4.7 through 7.1.3 are affected. The flaw was discovered by Umut Bayram of Picus Security.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 3 November, confirming evidence of real-world attacks, and ordered US federal civilian agencies to fix it by 6 November under Binding Operational Directive 26-04. That federal deadline has now passed, but the warning remains live for everyone else: any site still on an affected version is exposed.

WordPress security firm Wordfence, which assigned the CVE, reported blocking 13,095 attacks targeting the vulnerability within a 24-hour period. No specific compromised sites have been publicly confirmed, and CISA has not named any attacker.

Site owners should update to WordPress 7.1.4, or to the fixed release for their branch, as soon as possible, and check server logs and file integrity for signs of intrusion before the patch was applied. Sites on versions 2.7 through 4.6 received no fix and should be upgraded to a supported version.

[Source: itsecuritynews.info](https://www.itsecuritynews.info/cisa-warns-of-actively-exploited-wordpress-rce-flaw-2/) | [Source: picussecurity.com](https://www.picussecurity.com/resource/blog/cve-2026-119977-when-updating-wordpress-becomes-the-vulnerability)