[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXbNFBRci7nxVsD2-R5C8-0PPA-kI4pYqMfetNTDZnGU":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":117},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"bbf1b055-779d-4746-9e5a-257a8c5cf6f7","CISA Warns Hackers Are Exploiting 18-Year-Old WordPress Core Vulnerability","cisa-warns-hackers-are-exploiting-18-year-old-wordpress-core-vulnerability-85781a","CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch…","CISA has issued a warning regarding the exploitation of CVE-2026-119977, an 18-year-old WordPress core vulnerability. Attackers can hijack WordPress sites during core updates by exploiting how temporary installation files are handled, leading to remote code execution. WordPress has released version 7.1.4 to address the flaw, with fixes backported to older branches.","CISA warns of exploitation of an 18-year-old WordPress core vulnerability.","https:\u002F\u002Fhackread.com\u002Fcisa-hackers-exploiting-wordpress-core-vulnerability\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fcisa-hackers-exploiting-wordpress-core-vulnerability.jpg","2026-11-06T11:24:45+00:00","2026-11-06T12:00:27.27749+00:00",9,[17,20,23],{"name":18,"type":19},"WordPress","product",{"name":21,"type":22},"CISA","vendor",{"name":24,"type":25},"PHP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"cve","CVE-2026-119977","WordPress core vulnerability being exploited",[21,18],{"controls":51,"vendors":110},[52,81],{"slug":53,"name":54,"problem":55,"products":56},"patch-management","Automated patch management","Known holes get closed in days, not months.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":82,"name":83,"problem":84,"products":85},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[111],{"slug":112,"name":113,"logo_path":114,"roles":115},"picus-security","Picus Security","\u002Fvendor-logos\u002Fpicus-security.png",[116],"reported_by",{"slug":118,"title":119,"body":120,"framework_refs":121,"framework_notes":129},"18-year-old-wordpress-flaw-exploited-patch-now-or-risk-full-site-takeover","18-Year-Old WordPress Flaw Exploited: Patch Now or Risk Full Site Takeover","An 18-year-old vulnerability in WordPress core (CVE-2026-119977) is being actively exploited, allowing attackers to achieve remote code execution by abusing how temporary files are handled during core updates. The fact that this flaw went unpatched for nearly two decades across countless WordPress installations highlights a systemic failure in vulnerability lifecycle management. Organizations running outdated or unpatched WordPress versions are exposed to full site compromise, including data theft, defacement, and malware distribution. WordPress has released version 7.1.4 with backported fixes, making immediate patching the critical first step.",[122,123,124,125,126,127,128],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":130,"PCI DSS Requirement 6":131,"NIST SP 800-53 SI-2: Flaw Remediation":132,"OWASP A06:2021 Vulnerable and Outdated Components":133,"CIS Control 7: Continuous Vulnerability Management":134,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":135,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":136},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices, including patching — the exploitation of a publicly known, patchable flaw signals non-compliance with these obligations.","Requirement 6 mandates the development and maintenance of secure systems by promptly patching known vulnerabilities — any WordPress site processing payment data with this unpatched flaw would be in direct violation.","This control requires organizations to identify, report, and correct information system flaws on defined timelines — a mature SI-2 practice would have flagged and patched this WordPress vulnerability long before active exploitation began.","WordPress core being exploited due to an unpatched 18-year-old flaw is a textbook example of this OWASP risk category, which warns against running components with known vulnerabilities in production environments.","An 18-year-old vulnerability being actively exploited demonstrates the absence of continuous vulnerability scanning and timely remediation; this control mandates establishing processes to identify and remediate such flaws before attackers exploit them.","This annex control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, directly addressing the failure to detect and remediate this long-standing WordPress flaw.","Because successful exploitation leads to remote code execution and full site hijacking, enforcing least-privilege access controls and hardened update mechanisms aligns with this CSF function to limit the blast radius of compromised components."]