CISA Alerts Exploitation of WordPress Core Vulnerability (CVE‑2026‑119977) Enables Site Hijacking
What It Is — CISA has issued an emergency directive warning that threat actors are actively exploiting CVE‑2026‑119977, a flaw in the WordPress core update mechanism that dates back 18 years. The vulnerability allows an unauthenticated attacker to inject malicious code during a routine core upgrade, effectively hijacking the site and gaining full administrative control. Exploits are observed in the wild, and CISA’s advisory urges immediate remediation. The CVSS base score is reported as 9.8 (critical), and WordPress has released a patch that addresses the issue for all supported versions.
Affected Products — WordPress core (all supported versions prior to the 2024‑10‑15 security release).
Why It Matters for Trust & Control Assurance — This incident tests the control objective of secure configuration and timely patch management. Demonstrating that patches are applied promptly and that update processes are auditable is a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001, SOC 2).
Recommended Actions —
- Apply the WordPress 2024‑10‑15 security release to all sites immediately.
- Verify the integrity of the updated files using checksums provided by WordPress.
- Enable logging of core update events and retain logs for at least 90 days.
- Conduct a rapid inventory check to confirm no unauthorized admin accounts were created.
- Document the remediation steps in your change‑management system as audit evidence.