CISA Adds CVE-2026-119977 WordPress Core Flaw to KEV List

Key points

• CVE-2026-119977 is a high-severity WordPress Core vulnerability that can lead to code execution.
• CISA added the flaw to its KEV catalog, signaling confirmed exploitation.
• Attack activity has been reported in connection with upgrades.
• K-12 and government WordPress sites should patch and check for compromise.

CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, confirming that the WordPress Core flaw is being used in real attacks. Hackers are exploiting the issue, which is rated high severity and can allow code execution. That means an intruder who succeeds could run commands or introduce malicious code on an affected site. A KEV listing is a strong signal that defenders should treat the vulnerability as urgent rather than waiting for routine patch cycles.

The exposure is broad because WordPress Core underpins many public-facing and internal sites. For K-12 districts and government teams, that can include school websites, staff portals, district communications pages, and other content-managed services. Even where a site is not directly tied to student data, compromise can damage trust, disrupt services, and provide a foothold for further access.

Reports link the exploitation to upgrade activity, which makes maintenance windows a particular concern. Upgrades are often rushed or performed during limited change windows, and attackers may take advantage of transitional states or incomplete patching. Administrators should verify the actual Core version in use, confirm that updates completed successfully, and avoid assuming that an upgrade alone has closed the exposure.

The KEV addition changes the risk calculation. It means the vulnerability is not merely a theoretical weakness; it has been observed in active use. Organizations should prioritize remediation based on internet exposure and business criticality, then look for evidence of prior compromise rather than stopping at patching.

What to watch: vendor guidance for CVE-2026-119977, unexpected file changes, new or altered administrative accounts, and suspicious outbound connections. Keep an eye on CISA and WordPress advisories, and be prepared to re-check sites after upgrades and rollback events.

What to do now

1. Inventory every WordPress Core installation and record exact versions; prioritize internet-facing and district-critical sites.
2. Apply the vendor-provided fix for CVE-2026-119977 immediately, then confirm the update completed and the vulnerable version is gone.
3. If patching cannot be completed at once, reduce exposure by restricting administrative access and placing affected sites behind available protections.
4. Review web server, application, and authentication logs for signs of code execution, webshells, new admin users, or unexplained file changes.
5. Run integrity checks against known-good WordPress Core files and remove unauthorized modifications; preserve evidence before cleanup.
6. Rotate credentials and secrets for any site suspected of compromise, including admin, database, and service accounts.
7. Track CISA KEV and WordPress advisories, and re-verify patched sites after upgrade or rollback activity.

CVE references

• CVE-2026-119977

Original source

The Hacker News