CISA flags active exploitation of long-standing WordPress core bug

En bref

• CVE-2026-119977 affects WordPress core and has gone unaddressed for about 18 years.
• Attackers are already using it in the wild, with full site compromise as the outcome.
• CISA has published an alert and is telling administrators to update without delay.
• Any organization running WordPress, including school districts, should treat this as urgent.

CISA has issued an alert about CVE-2026-119977, a security defect in WordPress core that has persisted for close to two decades. According to the agency, malicious actors are not waiting for a proof-of-concept to mature — they are already using the bug against live installations. The flaw's age is the striking part: it has survived roughly eighteen years of releases, reviews and code churn inside one of the most widely deployed publishing platforms on the internet.

The exposure is broad by definition. Every organization running WordPress core is in scope, and in K-12 that means district public sites, school pages, athletics and communications portals, staff blogs and any number of departmental microsites stood up over the years and then forgotten. Because the weakness lives in core rather than in a plugin or theme, swapping out extensions will not help; the platform itself is the problem.

The consequence of a successful attack is severe: an intruder can end up controlling the site outright. Reporting on the flaw points to the core update path as the route being leveraged, which is especially concerning because update mechanisms are the component administrators rely on to fix problems. A vector that runs through the very machinery meant to deliver patches shortens the window between disclosure and compromise considerably.

Context matters here. WordPress underpins a very large share of the web, and a defect that old implies a long tail of installations that were never brought current — legacy sites, abandoned subsites, staging copies left reachable from the internet. CISA's involvement signals that this is being treated as more than a routine vendor patch cycle. For public-sector education agencies, an unpatched content management system is also a data exposure question, not just a website availability one.

What to watch: apply the current core release, then verify that the update actually landed on every instance rather than only the ones in your inventory. Watch for unexpected administrative accounts, modified core files and outbound connections from web servers in the days after patching. Expect follow-up guidance from CISA and the WordPress project as exploitation details become clearer.

À faire maintenant

1. Inventory every WordPress installation you own, including forgotten subsites, staging environments and legacy sites, and record the core version on each.
2. Apply the latest WordPress core release immediately, starting with internet-facing district and school sites, and confirm the version afterward rather than trusting that the update ran.
3. Take a verified backup before patching so you can restore quickly if an update breaks a theme or plugin dependency.
4. Place any site you cannot patch today behind a web application firewall or take it offline until it is updated.
5. Hunt for signs of compromise: new or elevated administrator accounts, altered core files, unexpected plugin or theme installations, and unfamiliar scheduled tasks.
6. If you find indicators of intrusion, rotate administrative credentials and authentication salts, force password resets, and preserve logs before cleanup.
7. Enable automatic updates for minor core releases and subscribe to CISA advisories so future core flaws are actioned the same day.

Références CVE

• CVE-2026-119977

Source originale

Hackread