CISA Alerts Exploitation of WordPress Core Vulnerability (CVE‑2026‑119977) Enables Site Hijacking

What happened

CISA’s emergency directive reports that threat actors are leveraging CVE‑2026‑119977, a vulnerability in the WordPress core update process that allows unauthenticated code injection during routine upgrades. The flaw, present for 18 years, grants attackers full administrative control of the compromised site. Exploits have been observed in the wild, prompting WordPress to release a critical patch (CVSS 9.8). The advisory urges all site owners to apply the patch without delay and to verify update integrity.

Why it matters for trust and compliance

• The episode underscores the need for a robust patch‑management control that provides auditable evidence of timely remediation, a control mapped across multiple frameworks.
• Showcase timely patch deployment as evidence for configuration‑management controls.
• Capture update logs and change‑management records to support audit readiness.

Who is affected

Recommended actions

1. Apply the WordPress 2024‑10‑15 security release immediately.
2. Validate file integrity with official checksums.
3. Enable and retain core‑update logging for at least 90 days.
4. Audit admin accounts for unauthorized creations.
5. Record remediation steps in your change‑management system.

Details

CVEs

CVE-2026-119977