If your company website runs on WordPress, this one is worth a few minutes. CISA has added a WordPress core vulnerability, tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities catalog after confirming that attackers are using it in the wild. It carries a high-severity score of 8.1.
What happened
The flaw is a race condition. During a full WordPress core upgrade, the software uses temporary staging locations that can be guessed and reached from the web. An attacker who hits that brief window can potentially run their own code on the server, and no login is required. Security firm Wordfence reported more than 18,500 requests aimed at these staging paths in the first 21 hours after details became public, and thousands of attacks were still being blocked each day afterward. Patches were released in late October.
Why it matters to small businesses
Many small businesses run a WordPress site that nobody checks regularly. The site may hold contact form submissions, customer details, or a login that reuses a password from elsewhere. Once an attacker can run code on the web server, they can plant malware, redirect visitors, or use the site as a stepping stone. Automatic updates help, but only if they are actually turned on and working.
What to do now
- Confirm your site is running the latest patched WordPress release, and update it today if it is not.
- Make sure you have a recent, tested backup stored somewhere other than the web server.
- Look for unfamiliar files, new administrator accounts, or odd redirects, and review access logs for requests to setup-config.php.
- Update plugins and themes at the same time, and remove any you no longer use.
- Ask whoever hosts or manages your site who is responsible for patching, and how quickly.
Not sure whether your website is patched or who is watching it? Call Arete Technology Systems at (317) 585-6100 and we can help you find out.
Source: The Hacker News, “CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades”