CISA Warns Hackers Are Actively Exploiting Critical WordPress Core Flaw for Remote Code Execution
U.S. cyber authorities say attackers are actively abusing a race-condition vulnerability in WordPress core, tracked as CVE-2026-119977, to run code on sites during upgrades. With more than 12,600 exploit attempts blocked in 24 hours, the bug turns routine maintenance into a potential takeover point for millions of websites.
A high‑severity flaw in WordPress core is under live attack, with U.S. cyber authorities warning that hackers are exploiting the vulnerability to run their own code on websites during routine software upgrades.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of the bug, tracked as CVE‑2026‑119977. The flaw is described as a race condition in WordPress core that can allow unauthenticated attackers—those without any login—to execute arbitrary code while the platform is performing core updates.
Security researchers say more than 12,600 exploit attempts were blocked in a single 24‑hour window, indicating that multiple threat actors have folded the vulnerability into automated scanning and attack campaigns. Details published by a leading security outlet describe attackers racing to plant malicious files at the moment WordPress replaces or moves core components during an upgrade, when normal checks can fail or be bypassed.
For site owners and administrators, the practical risk is straightforward and serious. If an attacker wins that race, they can often gain full control of the affected site: adding backdoors, redirecting traffic, stealing data submitted by users, or using the compromised server as a launchpad for further attacks. Because the bug affects WordPress core rather than a specific theme or plugin, it potentially touches a broad slice of the internet, from small blogs to corporate and government sites that rely on the platform.
The vulnerability is especially dangerous because it targets an operation—core upgrades—that is supposed to make sites safer. Many WordPress installations perform automatic background updates to stay current with security fixes. In this case, however, the update process itself becomes the moment of maximum exposure, giving attackers a predictable window to strike.
WordPress remains one of the world’s most widely used content‑management systems, powering a significant share of public websites. That popularity makes it a constant target for cybercriminals, who scan for known weaknesses that can be exploited at scale. A bug that allows unauthenticated code execution is a valuable prize; once packaged into simple tools, it can be used by low‑skilled attackers as well as more advanced groups.
From a broader cyber‑security perspective, the CVE‑2026‑119977 campaign shows how quickly attackers move to weaponize newly identified flaws. The sheer volume of blocked attempts in 24 hours suggests that as soon as proof‑of‑concept code or technical details became available, exploit traffic surged. It also underscores why patching guidance and mitigations from vendors and agencies like CISA now form part of basic operational security, not just best practice.
The ripple effects extend beyond individual site defacements. Compromised WordPress servers can be folded into botnets used for distributed denial‑of‑service (DDoS) attacks, credential‑stuffing operations or malware hosting, amplifying the impact on networks and users who never visit the original hacked sites. For organizations that handle customer data or provide critical information services, a silent takeover can turn into a regulatory and reputational crisis once discovered.
A simple takeaway captures the shift: when maintenance windows become attack windows, keeping software updated is no longer enough; the process of updating itself has to be secured and monitored.
Key signals to track in the coming days include emergency guidance or deadlines from CISA for federal agencies using WordPress, updates or patched releases from the WordPress core team that directly address the race condition, and any move by major hosting providers to roll out protective rules or temporary restrictions during core upgrades. Those steps will help show whether defenders can close this gap faster than attackers can exploit it.
Sources
- OSINT