CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

CISA has added a WordPress Core flaw, CVE-2026-119977, to its Known Exploited Vulnerabilities catalog, confirming active exploitation, The Hacker News reports. The time-of-check time-of-use race condition can let an unauthenticated attacker run code during a full core upgrade, and federal agencies have until November 6, 2026 to apply the fixes.