AQSh Kiberxavfsizlik va Infratuzilma Xavfsizligi Agentligi (CISA) WordPress Core'dagi xavfsizlik zaifligini Ma'lum Ekspluatatsiya Qilinadigan Zaifliklar (KEV) katalogiga qo'shdi va faol ekspluatatsiya dalillarini keltirdi.
Yuqori darajadagi zaiflik, CVE-2026-119977 (CVSS balli: 8.1) sifatida kuzatilgan, Time-of-check Time-of-use (TOCTOU) poyga sharti holati bo'lib, ta'sirlangan serverlarda ixtiyoriy kodni bajarishga erishish uchun ekspluatatsiya qilinishi mumkin. Zaiflik uchun tuzatishlar o'tgan oy oxirida chiqarilgan.
"WordPress Core'da time-of-check time-of-use (TOCTOU) poyga sharti zaifligi mavjud bo'lib, bu autentifikatsiya qilinmagan hujumchilarga yangilanish oynasi paytida serverda kodni bajarishga imkon berishi mumkin," deb aytdi CISA. "Bu to'liq paketli core yangilanishlari paytida ishlatiladigan bashorat qilinadigan, veb orqali kirish mumkin bo'lgan staging yo'llari tufayli."
Zaiflik tafsilotlari o'tgan hafta Wordfence ekspluatatsiya qilish uchun saytda hisob qaydnomasi talab qilinmasligini aytganida paydo bo'ldi. Biroq, bu hujumchidan to'liq Core yangilanishi paytida qisqa oynadan foydalanishni talab qiladi, bu autentifikatsiya qilinmagan kod bajarilishiga imkon berishi mumkin.
Ommaviy oshkor qilishdan keyingi dastlabki 21 soat ichida WordPress xavfsizlik kompaniyasi "setup-config.php" o'rnatuvchi yo'llariga qaratilgan 18 500 dan ortiq so'rovni qayd etdi. Yozish paytida, so'nggi 24 soat ichida zaiflikni ekspluatatsiya qilishga urinishlar 12 632 ta hujum bloklangan.
Previdian'dan telemetriya ma'lumotlari shuni ko'rsatadiki, Buyuk Britaniyada joylashgan IP manzildan uning honeypot sensorlariga qarshi uchta ekspluatatsiya urinishlari qayd etilgan. Ekspluatatsiya hodisalari 2026-yil 30-oktabrda kuzatilgan.
Endi ekspluatatsiya CISA tomonidan rasman tasdiqlanganligi sababli, Federal Fuqarolik Ijro Etuvchi Tarmoq (FCEB) agentliklari 2026-yil 6-noyabrgacha tuzatishlarni qo'llashlari kerak.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers. Patches for the flaw were released late last month.
"WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window," CISA said. "This is due to predictable, web-accessible staging paths used during full-package core upgrades."
Details of the flaw emerged last week when Wordfence said exploiting the vulnerability does not require an account on the site. That said, it does require an attacker to exploit a brief window during a complete Core update that could allow unauthenticated code execution.
During the first 21 hours after public disclosure, the WordPress security company said it recorded more than 18,500 requests targeting staged "setup-config.php" installer paths. As of writing, 12,632 attacks attempting to exploit the flaw have been blocked in the last 24 hours.
Telemetry data from Previdian shows that three exploitation attempts have been recorded against its honeypot censors from an IP address geolocated in the U.K. The exploitation events were observed on October 30, 2026.
With exploitation now officially confirmed by CISA, Federal Civilian Executive Branch (FCEB) agencies have time until November 6, 2026, to apply the fixes.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.