CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability

Hackread reports that CISA has warned attackers are exploiting a WordPress core vulnerability, tracked as CVE-2026-119977, that affects the updater's handling of temporary installation files and can allow remote code execution without an account on the targeted site. The flaw was found by Umut Bayram, a security researcher at Picus Security, carries a CVSS score of 8.1, and was added to CISA's Known Exploited Vulnerabilities catalog on November 3. Bayram traced the underlying behaviour to WordPress 2.7, released in 2008.

According to the report, WordPress released version 7.1.4 on October 28 to address the vulnerability, and security fixes were backported to older branches down to 4.7. Releases from 2.7 through 4.6 did not receive the fix and should be upgraded. Bayram recommends denying web access to wp-content/upgrade/ before starting the update, and says a standard wp core update command is not a substitute for manually replacing core files from a release extracted outside the public web directory.

Why it matters Administrators of WordPress sites running releases from 2.7 through 4.6 have no fix in the branch they run and need to upgrade, while sites on vulnerable releases that update through the existing updater remain exposed during the update window. Investigators should note that the researcher's own analysis, not a CISA attribution, describes the attack path, and that CISA has not named the attackers or said how many sites are compromised. Teams should check whether wp-content/upgrade/ is web-accessible before patching and review administrator accounts for unexpected additions.