# CISA Confirms Hackers Exploiting Core WordPress Flaw CVE-2026-119977 During Site Upgrades

*Wednesday, November 4, 2026 at 6:19 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-04T06:19:48.548Z (3h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/22456.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: U.S. cybersecurity officials say attackers are actively abusing a high-severity race condition in WordPress core, CVE-2026-119977, to run code on sites during core upgrades, with more than 12,600 exploit attempts blocked in 24 hours.

A newly disclosed flaw in WordPress core is under active attack, with U.S. cyber authorities warning that hackers are using it to compromise sites during software updates.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that attackers are exploiting CVE-2026-119977, a high-severity race condition in WordPress core. The bug allows unauthenticated code execution while a site is performing a core upgrade.

Monitoring has already recorded more than 12,600 exploit attempts in a 24‑hour period, according to reporting cited by CISA, indicating broad automated scanning rather than a handful of targeted intrusions.

Because the vulnerability triggers during the upgrade process, the same mechanism administrators rely on to keep WordPress secure can, if abused, open a window for attackers to drop malicious code. A successful exploit could let intruders take control of a site, alter content, or steal data.

WordPress is widely used by news outlets, small businesses, and public institutions, so reliable exploitation of CVE-2026-119977 can have outsized impact compared with bugs in niche platforms.

Signals to watch now include how quickly WordPress maintainers ship hardened fixes, whether hosting providers enforce patches or mitigations for customers, and if CISA adds the flaw to its catalog of known exploited vulnerabilities, which would impose patch deadlines on U.S. federal agencies.