CISA has confirmed that attackers are exploiting a WordPress core vulnerability that opens up while a site is being upgraded. The flaw, CVE-2026-119977, scores 8.1 on the CVSS scale. It is a time-of-check to time-of-use race condition that lets an unauthenticated attacker run code on a site’s server.
During a full-package core upgrade, the staging paths WordPress uses are predictable and reachable over the web. Attackers target that brief window and go after staged setup-config.php installer paths. Wordfence recorded more than 18,500 requests against those paths in the first 21 hours after disclosure and blocked 12,632 exploit attempts in the 24 hours before The Hacker News reported on the issue. A honeypot run by Previdian logged three attempts on October 30 from a U.K.-geolocated address.
Patches were released in late October. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until November 6 to apply fixes, a deadline that has now passed. The reporting does not name the fixed versions, so site owners should confirm the release in the official advisory, GHSA-4w3m-c66w-69mg, and update promptly.
Because the exposure is tied to the upgrade itself, administrators can review web logs for requests to installer paths such as setup-config.php around the times upgrades ran. Hosts that apply core updates for many sites at once have more to check than owners of a single site.