CISA added a WordPress core flaw to its exploited-vulnerabilities list. It can let attackers run code on a site during a full core update.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress core vulnerability, CVE-2026-119977 (CVSS 8.1), to its Known Exploited Vulnerabilities catalog because of active exploitation. The Hacker News reported the addition on 4 November 2026. WordPress released patches in late October.
The flaw is a race condition that can let an unauthenticated attacker run code on the server during the short window while a full-package WordPress core update is being installed. CISA linked the problem to predictable staging paths that are reachable from the web during these upgrades.
Attack activity
Security firm Wordfence said exploitation needs no account on the site, only that the attacker hits the brief update window. In the first 21 hours after disclosure, it saw more than 18,500 requests aimed at staged installer paths, and at the time of the report it said it had blocked 12,632 attacks in 24 hours. Previdian also recorded exploitation attempts against its honeypot on 30 October.
US federal agencies were given until 6 November 2026 to apply the fixes.
This article summarizes and comments on the source above in our own words. NC Solution is not affiliated with the source; read the original for full details.