CISA warns attackers are exploiting 18-year-old WordPress core flaw CVE-2026-119977
VULNERABILITYCVE-2026-119977redteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 8.1
- Exploited
- Yes
- Sources
- 1
What happened
CISA has confirmed in-the-wild exploitation of CVE-2026-119977, an 18-year-old WordPress core vulnerability that allows site hijacking during core updates. The article does not state affected or fixed versions, so administrators should check their WordPress core version against the vendor and CISA guidance and apply the update promptly.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update WordPress core to the fixed version as soon as possible.
- Check whether your WordPress sites are running a core version affected by CVE-2026-119977.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 3 updates
Who reported · 1 outlet
HackRead
Who and what is in it
Companies
Products