India, Nov. 4 -- The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are exploiting a serious vulnerability in WordPress Core. The flaw, tracked as CVE-2026-119977, carries a CVSS severity score of 8.1 and could allow hackers to execute malicious code on vulnerable servers during software updates.

CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue on November 3, 2026. WordPress has already released security fixes, making prompt verification of installed versions essential for website administrators.

The vulnerability affects the mechanism WordPress uses to install certain full-package Core updates. During an upgrade, WordPress temporarily extracts installation file...