Critical WordPress Vulnerability: Hackers Actively Exploiting CVE-2026-119977
The US Cybersecurity and Infrastructure Security Agency has confirmed that a critical flaw is being used for active cyberattacks.
A New Security Threat for WordPress
WordPress, the world’s most popular content management system, is facing a critical security issue. The US Cybersecurity and Infrastructure Security Agency (CISA) has officially confirmed that a vulnerability, identified as CVE-2026-119977, is being actively exploited in cyberattacks. The agency has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog and has urged relevant entities to address it immediately.
The issue is linked to the WordPress update process, specifically a "Time-of-check Time-of-use" (TOCTOU) race condition. This flaw allows attackers to execute arbitrary code on a server without requiring privileges. The attack is possible because the system uses predictable, web-accessible paths during full package updates. This provides hackers with a brief "window" during the update process to gain full control over the server.
Large-Scale Attacks and Recommendations
The WordPress security team addressed this issue in late October with the release of version 7.1.4. However, despite the availability of an official patch, many sites remain vulnerable. According to data from the security firm Wordfence, they recorded over 13,000 attempts to exploit this specific flaw within the last 24 hours alone.
While CISA’s directive primarily targets US federal agencies, the agency strongly advises the private sector and network security specialists not to delay system updates. This vulnerability serves as a common vector that cybercriminals are actively using to infiltrate servers and steal data.
Why This Matters for Users
A large portion of businesses, media outlets, and personal blogs are built on WordPress. Zero-day vulnerabilities like this, where exploits are already publicly available, pose a serious threat to any website that fails to apply security updates in a timely manner. In July of this year, WordPress faced a similar crisis when a chain of vulnerabilities known as "wp2shell" resulted in data breaches for thousands of small businesses and organizations.
If you manage a website on WordPress, the first and most important step is to update the system to the latest version. Additionally, it is recommended to review your plugins and activate security modules that block suspicious activity. Cybersecurity experts remind us that ignoring such flaws often results not only in website downtime but also in the leakage of sensitive user data.