CISA confirms WordPress upgrade flaw is under active exploitation
The flaw lets unauthenticated attackers execute code during full-package upgrades, and the first update to the fixed release can still leave sites exposed.
By Ryan Merket · Published · Updated
Primary source: WordPress.org
Why it matters
Routine WordPress maintenance creates the exposure: an attacker who polls a predictable staging path can turn the seconds spent unpacking an official update into unauthenticated code execution. The risk also complicates patching, because the old updater performs the first extraction before the fixed code takes over.
CISA added CVE-2026-119977, a race condition in WordPress Core's upgrade process, to its Known Exploited Vulnerabilities catalog on November 3rd, 2026, citing evidence of active exploitation. Federal Civilian Executive Branch agencies have until November 6th, 2026, to remediate under Binding Operational Directive 26-04.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.