CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch and protect upgrades.
The Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are exploiting a WordPress core vulnerability that can let them take over websites during an update. Tracked as CVE-2026-119977, the vulnerability affects the updater’s handling of temporary installation files and can allow remote code execution without an account on the targeted site.
The vulnerability was found by Umut Bayram, a security researcher at Picus Security. It carries a CVSS score of 8.1 and was added to CISA’s Known Exploited Vulnerabilities catalog on November 3.
Although the disclosure is recent, Bayram traced the underlying behaviour to WordPress 2.7, released in 2008. Public advisories list affected versions from 4.7 through 7.1.3, while his research describes older releases as affected too. Whether an installation can be exploited depends on its...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE