Hackers exploit vulnerability in WordPress update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed attacks via a vulnerability in the WordPress core. Under certain conditions, it allows code execution on the server without an account
CISA has added the WordPress vulnerability CVE-2026-119977 to its catalog of known exploited vulnerabilities. The issue lies in the site management system's own update mechanism.
The attack is related to a race condition—a situation where the outcome of an operation depends on the sequence of several parallel actions. The vulnerability may allow an outsider to execute code on the server at a specific moment during the installation of a full WordPress update.
Exploitation requires special conditions and precise timing within a narrow time window. This does not mean that any website can be hacked simply by opening a page. However, CISA has already confirmed the practical exploitation of the flaw.
A fix was released on October 28 as part of WordPress 7.1.4. Developers recommend installing the security update without delay. With automatic background updates enabled, the process should start on its own, but website owners should verify the actually installed version.
CISA has mandated U.S. federal civilian agencies to address the issue by November 6. While this deadline is not binding for other website owners, the agency advises them to prioritize the update as well.
Installing the patch closes the vulnerability but does not, in itself, confirm that the site was not compromised before the update.
