WordPress core flaw exploited in the wild; can allow server takeover
Original title：CISA KEV added CVE-2026-119977: WordPress WordPress Core – WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
What happened
A flaw in WordPress core's upgrade process lets unauthenticated attackers run code on the server, and CISA lists it as exploited in the wild. Sites could be taken over during upgrades.
Who is affected
- Anyone running a WordPress site
- Agencies maintaining WordPress sites
What to do
Check WordPress's official announcement for the fixed version and update as soon as possible. Until confirmed, review when upgrades run and check logs and files for suspicious activity.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 要確認 | 要確認 |
Why this flag
CISA KEV に掲載（悪用確認済み）かつ重大な影響
Red flag: session stopped — Exploitation confirmed with major impact. Assigned only when listed in CISA KEV or confirmed by a primary source.
Sources
- Primary source：CISA Known Exploited Vulnerabilities ↗
- CVE：CVE-2026-119977 ↗