CISA Warns Hackers Are Actively Exploiting WordPress Core Flaw for Code Execution
Hackers are exploiting a newly disclosed WordPress core race‑condition bug, CVE‑2026‑119977, to run code on vulnerable sites during upgrades, U.S. cyber authorities confirm. With more than 12,600 attack attempts blocked in 24 hours, the flaw turns routine maintenance windows into live intrusion opportunities for publishers, NGOs and small businesses.
A critical software bug in the world’s most widely used website platform has turned routine maintenance into a prime hacking window.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively targeting a high‑severity vulnerability in WordPress core, tracked as CVE‑2026‑119977. The flaw, a race condition during core upgrades, can allow unauthenticated attackers to execute arbitrary code on a site while it is updating — effectively taking control of the server if the exploit lands.
Security telemetry shows the scale of interest: more than 12,600 exploit attempts were blocked in a 24‑hour span, according to data shared with researchers. That volume points to automated campaigns sweeping the internet for vulnerable WordPress installations rather than narrowly targeted intrusions.
WordPress powers a huge share of the global web, from small personal blogs to news organizations, NGOs and government information portals. Many of those sites are maintained by small teams or non‑specialists who rely on built‑in auto‑update features to stay secure. CVE‑2026‑119977 hits exactly that workflow, abusing the brief moment when core files are being replaced to slip in hostile code.
For site owners, the risk is concrete. A successful exploit could let attackers implant backdoors, skim payment details from e‑commerce pages, inject disinformation into news articles, or conscript servers into botnets used for further attacks. Because the vulnerability can be triggered without prior authentication, any exposed site is a candidate target, regardless of how strong its passwords or user management policies may be.
The operational challenge is daunting for administrators responsible for fleets of WordPress sites. They need to identify which versions are affected, confirm that patches or mitigations have been applied correctly, and check logs for suspicious activity during recent update windows. Hosting providers and managed WordPress platforms also face pressure to roll out protections centrally, since many of their customers may be unaware of the technical details.
At a strategic level, the campaign underscores how much critical civic and commercial communication now rides on software maintained by a relatively small core team and an uneven ecosystem of third‑party plugins. A flaw in a popular plugin can be damaging; a flaw in WordPress core is infrastructure‑level risk. Adversaries know this and are quick to industrialize exploitation when such bugs are disclosed.
For governments and large organizations that use WordPress for public‑facing sites, the episode is a reminder that content management systems are not just publishing tools; they are attack surfaces that can be chained with other vulnerabilities to gain footholds deeper in a network.
One sentence worth remembering: the upgrade process that keeps sites safe most days is, for now, the exact doorway attackers are rushing to slip through.
The next indicators to watch include the release and adoption rate of any core patches or workaround guidance from the WordPress project; whether CISA adds CVE‑2026‑119977 to its catalog of known exploited vulnerabilities with deadlines for federal agencies; signs of mass compromises such as sudden waves of defaced or malware‑hosting WordPress sites; and updates from major hosting providers on their mitigations.
Sources
- OSINT