WordPress core flaw actively exploited during updates — patch now

The Hacker News reports that CISA has added a vulnerability in WordPress Core to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. The flaw, tracked as CVE-2026-119977 with a CVSS score of 8.1, is a Time-of-check Time-of-use race condition that can be triggered during the WordPress software upgrade process and exploited to achieve arbitrary code execution on the affected server. CISA's inclusion of a vulnerability in the KEV catalogue reflects confirmed evidence of exploitation rather than theoretical or potential risk, making this a development that warrants prompt attention from any organisation running WordPress.

Why this matters for UK organisations

WordPress powers a significant proportion of UK business websites, including corporate and marketing sites, e-commerce platforms, customer portals and internal tools. The nature of this vulnerability creates a particularly challenging operational situation: the flaw is triggered during the update process itself, meaning that organisations are potentially at elevated risk at the very moment they are attempting to improve their security posture by applying updates. This does not mean updates should be avoided — quite the opposite — but it does mean that the update process should be managed carefully, with monitoring in place and, where possible, updates applied in a controlled environment before being pushed to production. Organisations that rely on automated, unmonitored WordPress updates should review whether that approach remains appropriate given the active exploitation of this flaw.

What to review

IT and development teams should confirm as a priority that all WordPress installations in their environment have been patched against CVE-2026-119977. Where WordPress sites are managed by third-party agencies or hosting providers, confirmation of patching should be sought directly. Web application monitoring should be reviewed to ensure that unusual activity around update events — including unexpected file changes, new administrator accounts or outbound connections — would be detected. Organisations should also consider whether web application firewall rules are in place and up to date, and whether pre-update snapshots or staging environments are used to reduce the risk of a compromised update affecting production systems.

Source: The Hacker News