✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

TeamViewer Patches High-Severity Vulnerability Enabling RCE

November 2, 2026
Rewterz

Everest Group Claims Theft of 590GB of PwC Internal Data

November 5, 2026

CISA Flags Actively Exploited WordPress Core RCE Vulnerability

Severity

High

Analysis Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability in WordPress Core, tracked as CVE-2026-119977 (CVSS 8.1), to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. The flaw is a Time-of-check Time-of-use (TOCTOU) race condition that could allow unauthenticated attackers to execute arbitrary code on affected servers during a WordPress Core upgrade.

According to CISA, the vulnerability exists due to predictable, web-accessible staging paths used during full-package Core upgrades. Attackers can exploit a brief window during the update process to access staged installer files, including setup-config.php, and execute malicious code without requiring a WordPress account. Security patches addressing the vulnerability were released by WordPress in late October 2026.

Wordfence reported significant exploitation activity shortly after the vulnerability's public disclosure. Within the first 21 hours, the security company recorded more than 18,500 requests targeting staged installer paths. Its threat intelligence telemetry also showed that 12,632 exploitation attempts were blocked within a 24-hour period, highlighting growing attacker interest in the vulnerability.

Additionally, telemetry recorded three exploitation attempts against its honeypot sensors on October 30, 2026, originating from an IP address geolocated in the United Kingdom. These findings, combined with CISA's confirmation of active exploitation, indicate that the vulnerability is being targeted in real-world attacks.

Following its inclusion in the KEV catalog, CISA directed Federal Civilian Executive Branch (FCEB) agencies to apply the available security updates by November 6, 2026. Organizations running affected WordPress Core versions should prioritize installing the latest patched release to prevent potential remote code execution and server compromise.

Impact

  • Unauthorized Access
  • Remote Code Execution

Indicators of Compromise

CVE

  • CVE-2026-119977

Remediation

  • Update WordPress Core to the latest patched version to eliminate the TOCTOU vulnerability.
  • Verify the installed WordPress version and ensure all affected installations are patched.
  • Restrict public access to staging and upgrade directories to prevent unauthorized access.
  • Monitor web server logs for suspicious requests targeting setup-config.php and other installer paths.
  • Deploy a Web Application Firewall (WAF) to detect and block exploitation attempts.
  • Review server files and processes for unauthorized modifications or suspicious code execution.
  • Remove any exposed or leftover staging files after completing WordPress upgrades.
  • Investigate suspicious activity and rotate administrative credentials if compromise is suspected.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo