Hackers Launch 240,000 Exploit Attempts WordPress Core Flaw Enabling Remote Code Execution

A critical WordPress Core vulnerability (CVE-2026-119977) was exploited over 240,000 times beginning the very day its patch was released, exposing the dangers of delayed or unautomated patching. The flaw stems from a race condition during the WordPress upgrade process, allowing attackers to access temporary installer files before cleanup completes — a subtle but severe logic error in a widely deployed platform. The simultaneous timing of patch release and mass exploitation highlights how threat actors actively monitor vulnerability disclosures and move immediately, leaving organizations with virtually no reaction window. Sites running outdated WordPress versions remain exposed, underscoring that vulnerability management must be proactive, automated, and continuously monitored rather than reactive.