# CISA Confirms Active Exploits of WordPress Core Flaw That Enables Unauthenticated Code Execution

*Wednesday, November 4, 2026 at 6:12 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-04T06:12:32.794Z (3h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22427.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A high-severity race-condition bug in WordPress Core, tracked as CVE-2026-119977, is under active attack, with over 12,600 exploit attempts blocked in 24 hours and U.S. cyber officials warning that it can allow attackers to run code during site upgrades without logging in.

Hackers are actively exploiting a newly disclosed vulnerability in WordPress Core that can let them run their own code on websites during core software upgrades, prompting a formal alert from U.S. cyber authorities.

The flaw, tracked as CVE-2026-119977, is described as a high-severity race condition in the system that handles WordPress core updates. A race condition is a timing problem: if an attacker can interfere at the moment files are being replaced or modified, they may be able to insert malicious code before security checks complete.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attacks using this bug are underway. Over 12,600 exploit attempts were blocked in a 24-hour period, according to publicly shared data, indicating that automated scanning and mass probing have already begun. The vulnerability allows unauthenticated code execution during the core upgrade process, meaning attackers don’t need valid credentials if they can hit that narrow window.

For organizations that rely on WordPress to run news sites, online stores, government pages, or internal portals, successful exploitation could give intruders control over servers. Once they can execute code, attackers can alter content, steal stored data, deploy credential stealers, or use compromised sites as infrastructure for wider campaigns.

Smaller organizations and public bodies that depend heavily on automatic updates face particular risk, because the upgrade mechanism they rely on is the point being targeted. Since the bug sits in WordPress Core rather than in a specific plugin or theme, it affects a broad range of installations regardless of which extensions they use.

Compromised WordPress servers often become staging grounds for phishing pages, malware distribution, or attempts to pivot deeper into an organization’s network. That turns what might look like a website problem into a potential foothold for larger intrusions.

Administrators and hosting providers are watching for guidance on patched WordPress versions, safe ways to run upgrades, and hardening steps that narrow or close the timing gap attackers are exploiting. Security teams are also monitoring whether CISA adds CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, which would set patch deadlines for U.S. federal civilian agencies and influence risk priorities in the private sector.