CISA Warns of Active Exploitation of 18-Year-Old WordPress Core Vulnerability (CVE-2026-119977)

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of an 18-year-old WordPress core vulnerability, tracked as CVE-2026-119977. This flaw allows attackers to take over websites during updates by exploiting the updater's handling of temporary installation files, potentially leading to remote code execution without authentication. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on November 3, 2026, and set a remediation deadline of November 6, 2026, for applicable federal systems.