CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability
CISA warns of exploitation of an 18-year-old WordPress core vulnerability.
Run CISA?
Get an email when a reviewed story names CISA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
CISA has issued a warning regarding the exploitation of CVE-2026-119977, an 18-year-old WordPress core vulnerability. Attackers can hijack WordPress sites during core updates by exploiting how temporary installation files are handled, leading to remote code execution. WordPress has released version 7.1.4 to address the flaw, with fixes backported to older branches.
The lesson from this incident
Full lessonAn 18-year-old vulnerability in WordPress core (CVE-2026-119977) is being actively exploited, allowing attackers to achieve remote code execution by abusing how temporary files are handled during core updates. The fact that this flaw went unpatched for nearly two decades across countless WordPress installations highlights a systemic failure in vulnerability lifecycle management. Organizations running outdated or unpatched WordPress versions are exposed to full site compromise, including data theft, defacement, and malware distribution. WordPress has released version 7.1.4 with backported fixes, making immediate patching the critical first step.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-119977