Overview
- CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog Wednesday and told Federal Civilian Executive Branch agencies to apply fixes by November 6.
- The flaw is a TOCTOU race condition that lets unauthenticated attackers run code during a short period when WordPress stages full-package upgrade files in predictable, web‑accessible directories.
- WordPress released a patch in version 7.1.4 that fixes the issue for installations running versions 4.7 through 7.1.3, but many sites remain unpatched and vulnerable until they update.
- Security firms recorded rapid, automated scanning after the fix was published, with Wordfence logging more than 18,500 requests targeting staged installer paths in the first 21 hours and Previdian seeing probe attempts against a honeypot.
- Operators should update to 7.1.4 immediately, monitor web and upgrade logs for signs of exploitation, and use defensive controls because the brief upgrade window makes detection and rapid patching the best ways to limit real-world compromise.