CISA added CVE-2026-119977, an actively exploited flaw in WordPress Core, to its Known Exploited Vulnerabilities catalog on November 4, 2026. It is a WordPress core update hack in the most literal sense. For a brief window during a routine full upgrade, an attacker with no login can run code on your server, which puts nearly every WordPress site in scope.
