WordPress Update Flaw Under Active Attack: Patch Now If You Run a Site

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress Core vulnerability, tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities catalog after finding evidence of active attacks. The flaw has a severity score of 8.1 and is a race condition: attackers can take advantage of a brief window while WordPress performs a complete core update. CISA says the cause is predictable, web-accessible staging paths used during these upgrades. Patches were released late last month.

According to Wordfence, the attacker does not need an account on the site. If the timing works, an unauthenticated attacker could run code on the server. Wordfence recorded more than 18,500 requests targeting staged "setup-config.php" installer paths in the first 21 hours after public disclosure. It also reports that 12,632 exploitation attempts were blocked in the latest 24-hour period. Separately, Previdian recorded three attempts against its honeypot sensors from a U.K.-based IP address on October 30, 2026.

With exploitation confirmed, U.S. Federal Civilian Executive Branch agencies must apply the fixes by November 6, 2026. Australian businesses are not bound by that deadline, but the scale of scanning and attack activity suggests WordPress sites that have not been patched are likely to be targeted.