AQSh Kiberxavfsizlik va Infratuzilma Xavfsizligi Agentligi (CISA) federal agentliklarga ogohlantirish berdi, hujumchilar yaqinda tuzatilgan yuqori darajadagi WordPress zaifligini yovvoyi tabiatda foydalanishni boshlagan.
CVE-2026-119977 sifatida kuzatilgan bu yuqori darajadagi WordPress Core zaifligi Time-of-check Time-of-use (TOCTOU) poyga sharoitidan kelib chiqadi va Picus Security tadqiqotchisi Umut Bayram tomonidan xabar qilingan.
Muvaffaqiyatli foydalanish huquqsiz masofaviy tahdidchilarga serverda kodni bajarishga imkon beradi, yuqori murakkablikdagi hujumlarda, to'liq paketli yadro yangilanishlari paytida ishlatiladigan bashorat qilinadigan, vebga kirish mumkin bo'lgan sahnalash yo'llari tufayli.
"WordPress yangilash jarayonidagi zaiflik, yangilash oynasi davomida masofaviy kod bajarilishiga olib kelishi mumkin," deb aytdi WordPress xavfsizlik jamoasi 28-oktabrda, ushbu xavfsizlik muammosini hal qilish uchun WordPress 7.1.4 ni tuzatishlar bilan chiqarganida. "Bu xavfsizlik relizi bo'lgani uchun, saytlaringizni darhol yangilashingiz tavsiya etiladi."
CISA CVE-2026-119977 faol foydalanilishini seshanba kuni tasdiqladi va zaiflikni o'zining Ma'lum Foydalanilgan Zaifliklar (KEV) Katalogiga qo'shdi, Federal Fuqarolik Ijroiya Filiali (FCEB) agentliklariga tizimlarini juma kunigacha himoya qilishni buyurdi, BOD 26-04 majburiy operatsion direktivasi talab qilganidek.
"Ushbu turdagi zaiflik yomon niyatli kiber aktyorlar uchun tez-tez hujum vektori bo'lib, federal korxonaga jiddiy xavf tug'diradi," deb ogohlantirdi kiberxavfsizlik agentligi.
BOD 26-04 faqat AQSh federal agentliklarini maqsad qilgan bo'lsa-da, CISA barcha tarmoq himoyachilarini, shu jumladan xususiy sektordagilarni ham, serverlarini himoya qilish uchun ushbu zaiflikni tuzatishni ustuvor qilishga chaqirdi.
CISA CVE-2026-119977 ni yovvoyi tabiatda foydalanish haqida ko'proq tafsilot bermagan bo'lsa-da, WordPress xavfsizlik firmasi Wordfence dam olish kunlari yangilangan maslahatida "o'tgan 24 soat ichida ushbu zaiflikni nishonga olgan 13 095 hujumni bloklaganini" aytadi.
Iyul oyida WordPress xavfsizlik jamoasi WordPress Core'dagi muhim zaiflik zanjirini (wp2shell deb nomlangan) ham tuzatdi, bu REST API batch-route chalkashlik zaifligi (CVE-2026-63030) va SQL in'ektsiya zaifligi (CVE-2026-60137) orqali vebshellarni joylashtirish va tuzatilmagan serverlarni egallab olish uchun suiiste'mol qilinishi mumkin.
Ommaviy wp2shell ekspluatlari tuzatishlar jonli bo'lganidan bir kun o'tib chiqarildi va hujumchilar bir necha kun o'tib tuzatilmagan serverlarga kirib, doimiy vebshellarni joylashtirish va zararli plaginlarni o'rnatishni boshladilar.
Xitoy tilida gapiradigan tahdid aktyori sentyabr oyida wp2shell ekspluat zanjirini qurollantirib, kichik biznes va davlat tashkilotlariga tegishli orqa fon ma'lumotlar bazalarida saqlangan 18 500 dan ortiq yozuvdan nozik ma'lumotlarni o'g'irladi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xatti-harakatini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan nima o'tib ketayotganini ko'ring, MX o'zgarishlarisiz.
Bepul elektron pochta xavfsizlik skaneringizni boshlang.
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild.
Tracked as CVE-2026-119977, this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram.
Successful exploitation can let remote threat actors without privileges execute code on the server in high-complexity attacks due to predictable, web-accessible staging paths used during full-package core upgrades.
"A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window," the WordPress security team said on October 28 when it released WordPress 7.1.4 with patches to address this security issue. "Because this is a security release, it is recommended that you update your sites immediately."
CISA confirmed CVE-2026-119977 active exploitation on Tuesday and added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their systems by Friday, as mandated by Binding Operational Directive (BOD) 26-04.
"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the cybersecurity agency warned.
Although BOD 26-04 targets only US federal agencies, CISA urged all network defenders, including those in the private sector, to prioritize patching this vulnerability to protect their servers.
While CISA didn't provide more details on attackers exploiting CVE-2026-119977 in the wild, WordPress security firm Wordfence says in an advisory update over the weekend that it "blocked 13,095 attacks targeting this vulnerability in the past 24 hours."
In July, the WordPress security team also patched a critical vulnerability chain in WordPress Core (named wp2shell) that can be abused to deploy webshells and take over unpatched servers by exploiting a REST API batch-route confusion vulnerability (CVE-2026-63030) and an SQL injection flaw (CVE-2026-60137).
Public wp2shell exploits were released one day after the patches went live, and attackers began breaching unpatched servers a few days later to deploy persistent webshells and install malicious plugins.
A Chinese-speaking threat actor also weaponized the wp2shell exploit chain in September to steal sensitive data from more than 18,500 records stored in backend databases belonging to small businesses and government organizations.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.