Ethical Hacking News
CISA Warns of Unauthenticated Code Execution on WordPress Servers Due to Newly Identified Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability. A high-severity vulnerability has been identified in WordPress Core, allowing unauthenticated attackers to execute arbitrary code on affected servers. Users are urged to apply the patches as soon as possible to prevent potential exploitation.
WordPress users have been warned about a newly identified vulnerability (CVE-2026-119977) that could allow unauthenticated attackers to execute arbitrary code on affected servers. The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition that occurs during full-package core upgrades, allowing attackers to exploit predictable staging paths. According to CISA, this vulnerability could be exploited to achieve arbitrary code execution on affected servers. Wordfence recorded over 18,500 requests targeting the vulnerability's staging paths within the first 24 hours after public disclosure. As of the writing of this article, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours. CISA has advised FCEB agencies to apply the fixes by November 6, 2026, to prevent potential exploitation of the vulnerability. Regular software updates and vigilance are crucial to protect websites against potential attacks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to WordPress users about a newly identified vulnerability in the core software that could allow unauthenticated attackers to execute arbitrary code on affected servers. The vulnerability, tracked as CVE-2026-119977, has been classified as a high-severity vulnerability with a CVSS score of 8.1.
The vulnerability is a case of Time-of-check Time-of-use (TOCTOU) race condition that occurs during full-package core upgrades. This vulnerability allows an attacker to exploit predictable, web-accessible staging paths used during the upgrade process. According to CISA, this vulnerability could be exploited to achieve arbitrary code execution on affected servers.
The vulnerability was first reported by Wordfence, a security company that tracks and analyzes vulnerabilities in WordPress. Wordfence stated that exploiting the vulnerability does not require an account on the site, but rather an attacker must exploit a brief window during a complete core update. During the first 21 hours after public disclosure, Wordfence recorded over 18,500 requests targeting staged "setup-config.php" installer paths.
As of the writing of this article, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours. Telemetry data from Previdian shows that three exploitation attempts have been recorded against its honeypot censors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026.
With the vulnerability now officially confirmed by CISA, Federal Civilian Executive Branch (FCEB) agencies have until November 6, 2026, to apply the fixes. It is essential for WordPress users to apply the patches as soon as possible to prevent potential exploitation of this vulnerability.
The implications of this vulnerability are significant, as it highlights the importance of regular software updates and the need for users to stay vigilant in protecting their websites against potential attacks. As the threat landscape continues to evolve, it is crucial for users to stay informed about the latest vulnerabilities and take proactive steps to protect their online assets.
Related Information:
https://www.ethicalhackingnews.com/articles/CISA-Warns-of-Unauthenticated-Code-Execution-on-WordPress-Servers-Due-to-Newly-Identified-Time-of-Check-Time-of-Use-TOCTOU-Race-Condition-Vulnerability-ehn.shtml
https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html
Published: Wed Nov 4 02:15:29 2026 by llama3.2 3B Q4_K_M
