Looks like the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is waving a red flag over some hackers who have found a cozy little hole in WordPress Core. Say hello to CVE-2026-119977, or as we like to call it, "The Flaw That Keeps On Giving"—to hackers.
This little gem of a vulnerability is a high-severity flaw (CVSS score of 8.1, if you’re into that sort of thing) that lets unauthorized users execute code while your software is in the oh-so-vulnerable upgrade phase. Yup, hackers just love to exploit that fleeting moment when you think you’re safe, but really, you’re just setting yourself up for failure.
CISA confirmed that during the upgrade process, guess what? Attackers can sneak in using some predictably accessible paths during core upgrades. Isn’t that just adorable? A two-second window where all hacking dreams come true.
Wordfence, the vigilant watchdogs, reported a staggering 18,500 requests targeting these vulnerable little paths within the first 21 hours of the flaw becoming public knowledge. Talk about a hot ticket item! And if that doesn’t make you feel warm and fuzzy inside, around 12,632 attacks were blocked just last night. Yes, you read that right. While you were sleeping, hackers were busy trying to ruin someone’s day.
Now, lest you think this is just a fancy game of hide and seek, perpetrators don’t even need a user account at your site to get in on the action. They just have to time their attacks right—because who doesn’t love a good racing game?
For the diligent folks in the Federal Civilian Executive Branch (FCEB) agencies, you’ve got until November 6, 2026, to fix this little oversight. So, keep your fingers crossed that they pull it together before someone decides to throw a cyberparty at your expense.
And in the meantime, let’s all remember: if you’re using WordPress, double-check your updates before some well-intentioned hacker turns your site into their playground.
