CISA KEV · WordPress · Active Exploitation · Remote Code Execution
CVE-2026-119977: WordPress Core Upgrade-Window Flaw Added to CISA KEV After Attacks on the Staged Installer
A WordPress Core race condition that runs code during a core update is now on CISA KEV. Attackers are polling the staging path and waiting for sites to update. Here is who is affected, the fixed versions, and what to do.