CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

AI Summary

CISA added CVE-2026-119977 — a Time-of-check Time-of-use (TOCTOU) race condition in WordPress Core with a CVSS score of 8.1 — to its Known Exploited Vulnerabilities catalog following confirmed active exploitation in the wild. The flaw enables arbitrary code execution and is being triggered during software upgrade processes. Federal agencies face a mandatory remediation deadline, and all WordPress administrators should prioritize patching immediately.

Read full article → https://thehackernews.com/2026/11/cisa-confirms-ha…

Relevance score: 83.0/100

# More from November 05

1
Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft The Hacker News
2
French blood service hit by Europe-wide cyberattacks on refrigeration The Record
3
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits The Hacker News
4
Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory The Hacker News
6
cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes The Hacker News
7
Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction The Hacker News
8
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges The Hacker News
9
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches BleepingComputer
10
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus The Record