Actively Exploited WordPress Core Flaw Hits CISA KEV — Plus a CVSS 10.0 Plugin Bug Districts Must Sweep For

CISA flags actively exploited WordPress Core flaw CVE-2026-119977 plus a CVSS 10.0 plugin bug. Patch, hunt and rotate credentials now.

  • CISA added CVE-2026-119977, a WordPress Core time-of-check/time-of-use race condition, to its Known Exploited Vulnerabilities catalog on 3 November 2026 based on evidence of active exploitation.
  • Separately, attackers are probing CVE-2026-81648, an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that can expose wallet credentials, according to Defused Cyber reporting.
  • Any district, school or departmental WordPress site that is unpatched is a candidate for unauthenticated remote code execution, webshell placement and credential theft — treat remediation as an emergency change, not routine maintenance.

What to do now

  1. Inventory every WordPress instance you operate or sponsor — district sites, school sites, athletics and fundraising pages, departmental microsites and forgotten shadow-IT blogs — recording core version, installed plugins, owner and internet reachability.
  2. Apply the current fixed WordPress Core release to all installations immediately as an emergency change; confirm the exact fixed version in the official WordPress security release notes rather than assuming, and clean up any leftover upgrade staging directories on the web root.
  3. For CryptoPayment Gateway: deactivate and delete the plugin if it is not required; if it is required and no fixed release exists, take the payment page offline, and in the interim push WAF or virtual-patching rules covering CVE-2026-81648 and CVE-2026-119977.
  4. Hunt for compromise: unexpected administrator accounts, modified core files, unfamiliar scheduled tasks or cron entries, injected scripts and redirects, new outbound connections, and web-server log entries showing requests to predictable staging paths around upgrade windows.
  5. Rotate administrator credentials, database passwords and authentication salts/keys on any site that was exposed while unpatched, verify backups are clean and restorable, block WordPress 7.2 Beta 4 from all production systems, and report suspected compromises to your security operations contact.

Related items