Actively exploited WordPress core flaw: update and check your business website

CVE-2026-119977 · WordPress WordPress Core · added to the CISA Known Exploited Vulnerabilities catalog on November 3, 2026

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress flaw, CVE-2026-119977, to its list of vulnerabilities that attackers are already using. It affects WordPress Core, the software behind many small business websites, including those of dental and medical practices, law firms and accounting offices.

What happened

When WordPress installs a full core upgrade, it briefly stores upgrade files in temporary folders with predictable names that can be reached from the web. During that short upgrade window, an attacker who does not need a login can race the upgrade and run their own code on your web server. The flaw is rated high severity (CVSS 8.1). There are no reports yet of ransomware groups using it, but a hacked website can be used to steal form submissions, spread malware to visitors or damage your reputation.

Who is affected

Any business running a self-hosted WordPress website. CISA's listing does not name specific affected versions, so check with WordPress, your web host or your IT provider about the fix for your site.

What to do now

• Apply WordPress's fix as instructed by the vendor, and keep core updates current.
• Ask your web host or developer whether your site has been updated and whether they offer a web application firewall.
• Look for signs of compromise: unknown admin accounts, unfamiliar files or plugins, or unexpected redirects.
• Make sure you have a recent backup of the site stored somewhere other than the web server.
• Change WordPress and hosting passwords if anything looks suspicious.

RedCube IT Services is already checking and patching the WordPress websites we manage for our clients. If you are not a client and want help making sure your website is safe, contact us for a free security check.