CVE-2026-119977 lets hackers hijack WordPress sites during core updates. CISA confirms exploitation as users are told to patch…

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress flaw, tracked as CVE-2026-119977 (CVSS score of 8.1), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-119977 is a high-severity remote code execution vulnerability affecting WordPress versions 4.7 through 7.1.3. It stems from predictable, web-accessible staging directories used during core updates.

Unauthenticated attackers could exploit a race condition to execute malicious code on the server while an update is in progress, potentially compromising the website. WordPress addressed the flaw in version 7.1.4.

Threat actors began scanning for CVE-2026-119977 shortly after WordPress released the security update. Wordfence recorded more than 18,500 requests targeting vulnerable staging installer paths within the first 21 hours. However, these figures document exploitation attempts, not confirmed successful compromises.

“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths.” reads the report published by Wordfence.

“Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window. Other sources tested many staging-directory and version-name variations.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by November 6, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-119977)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window. CISA added this vulnerability to the catalog on November 3, 2026, […]

The post CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A phishing campaign impersonating OpenAI is using disposable WordPress websites and live attacker oversight to steal payment card details and potentially capture one-time passwords. Fraudulent ChatGPT Plus billing emails warn that subscription payments have failed, directing recipients to counterfeit checkout pages where operators control the victim’s next step. The operation combines infrastructure churn with interactive […]

The post New ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical WordPress Core vulnerability is exploited in the wild. Update to WordPress 7.1.4 immediately to fix the unauthenticated race condition RCE.

Related Posts:

• Android SMS of Death Bug Triggers Remote Reboots
• JetBrains Patches Critical Flaws in IDEs and Background Services After Certificate Breach
• CERT/CC Warns of Xerj Authentication Bypass Flaw CVE-2026-97406

The post WordPress Core Vulnerability Exploited in the Wild appeared first on Daily CyberSecurity.

Details and PoC exploit code are out for critical libheif vulnerabilities GHSA-x8r2-mggj-j6wr and GHSA-2jg2-4ch7-h545. Upgrade to 1.23.3 now.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post Public PoC Exploit Disclosed for Critical libheif RCE Vulnerabilities appeared first on Daily CyberSecurity.

Hackers exploit YOOtheme Pro vulnerability CVE-2026-102785 (CVSS 10) for remote code execution, dropping webshells. Update to 5.0.53 now.

Related Posts:

• Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
• Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
• Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

The post YOOtheme Pro Vulnerability CVE-2026-102785 (CVSS 10) Exploited for Remote Code Execution appeared first on Daily CyberSecurity.

Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123. They warn that WordPress websites using this compromised plugin are at risk if administrators activated it. The company has removed the affected files and released a clean version, 3.0.124. Rank Math PRO Compromised The incident impacts a limited number […]

The post Rank Math PRO WordPress Plugin Compromised to Spread Malware and Steal Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin. Public exploit code and observed exploitation have made unpatched deployments an […]

The post Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Update Rank Math SEO PRO to 3.0.124 now. CVE-2026-111862 is a critical supply-chain compromise actively exploited in the wild via embedded malware.

Related Posts:

• Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection
• PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host
• CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras

The post Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123 appeared first on Daily CyberSecurity.

Update the Backuply WordPress plugin to 1.5.9 to fix CVE-2026-93953, a high-severity SQL injection vulnerability impacting 600,000 sites.

Related Posts:

• Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection
• PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host
• CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras

The post Backuply WordPress Plugin Patched for High-Severity SQL Injection Vulnerability appeared first on Daily CyberSecurity.

Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code. It is tracked as CVE-2026-85097 and has a CVSS score of 10.0, affecting versions up to 3.1.8.9. Administrators are advised to upgrade to version 3.1.8.10 or later. Patchstack disclosed […]

The post Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

An active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now.

Related Posts:

• Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials
• wolfSSH 1.6.0 Fixes Five Flaws, Including Critical Host Key Bypass CVE-2026-16516
• Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027

The post Hackers Exploit Ninja Forms and WPC Product Bundles XSS Flaws to Plant Hidden WordPress Admins appeared first on Daily CyberSecurity.

The WordPress 7.1.3 security update is a WordPress security release that fixes stored XSS, SQL injection and more. Update your site now.

Related Posts:

• CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
• Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
• ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3

The post WordPress 7.1.3 Security Update Fixes Stored XSS, SQL Injection and Five More Flaws appeared first on Daily CyberSecurity.

WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses.

The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported.

The release documentation lists seven security issues, although its introductory sentence describes “one security fix.” It provides no CVE identifiers, severity scores, or confirmed exploitation details. Consequently, the headline’s critical wording should not be interpreted as an official severity classification for every vulnerability.

One vulnerability involves stored cross-site scripting on the Comments administration page. Pending comments provide the attack surface, potentially exposing administrators when they review submitted content.

Thomas Chauchefoin of Trail of Bits reported this issue. The disclosure does not describe the malicious payload or precise conditions required for successful exploitation.

A separate cross-site scripting weakness affects Imgur embeds. WordPress credits Zhengyu Liu, Jingcheng Yang, and Gavin Zhong with reporting it.

These two findings concern different content pathways: comment moderation and embedded media. Both make the update relevant to sites that process user content or display externally sourced material.

WordPress Vulnerabilities

Anthropic reported a second-order SQL injection vulnerability in WordPress WXR export. The release identifies the export component but does not explain the injection sequence, required permissions, or database impact.

Administrators should therefore avoid assuming that the issue enables unrestricted database access or that every export operation is exploitable. Another vulnerability allows unauthenticated disclosure of comments associated with private and unpublished posts.

Reported by Ananda Dhakal of Patchstack, this issue affects information expected to remain outside public access. The announcement identifies comments as the exposed data it does not claim that attackers can retrieve complete private posts.

Anthropic also reported a weakness that lets users with the Author role make posts sticky. This represents an authorization problem involving a publishing capability.

Separately, Alex Concha of the WordPress security team reported forgeable parameters passed to the {status}_{type} hook that can produce action name collisions. The announcement leaves the broader exploitation consequences unspecified.

A denial-of-service issue affects the WP_Http::make_absolute_url() method. Anthropic reported this finding as well, but WordPress provides no request pattern, resource-consumption measurements, or detailed attack prerequisites in the release notes.

Administrators can install WordPress 7.1.3 through Dashboard > Updates or obtain it from the official releases page. WordPress explicitly recommends updating sites immediately because this is a security release. Older affected branches also receive these fixes, but that doesn’t change the project’s stated support policy.

The revised files span administration JavaScript, export handling, REST posts, customization, HTTP processing, embeds, queries, and post operations. No packages were revised.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks appeared first on Cyber Security News.

A WordPress libheif RCE chain and its PoC are now public. The libheif vulnerability turns an HEIC upload into code execution. Patch to 1.23.3.

Related Posts:

• CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
• Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
• ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3

The post Researchers Publish Full Details and PoC Exploit for a WordPress libheif RCE Chain appeared first on Daily CyberSecurity.

A credential-collection toolkit dubbed TIKTOUK that combines WordPress reconnaissance, exposed-file harvesting, plugin credential decryption, and JavaScript secret scanning. The toolkit consists of two Python scripts, wp2s_poll.py and wp2s_crack.py, alongside a stripped Go-based Linux crawler named jscrawl-amd64. All three components retrieve targets from a central HTTP hub, execute assigned collection tasks, and submit status reports and […]

The post TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly analyzed WordPress malware family, tracked as SC for the “SC_” markers embedded in its injected code, uses a self-healing persistence mesh that can restore a deleted backdoor within seconds. Researchers found that SC does not rely on a single web shell or plugin. Instead, the malware creates at least eight interdependent persistence points, […]

The post SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress Core flaw, tracked as CVE-2026-87902 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-87902 allows an unauthenticated attacker to make the get_page_template() function include a readable local PHP file outside the active theme directories. Under specific server and theme conditions, the flaw can lead to remote code execution. The vulnerability is being actively exploited, with attackers using pearcmd.php to write malicious PHP files and execute code.

This week, WordPress released version 7.1.2 to address this flaw. It stems from how the CMS resolves page templates, with a real path to remote code execution.

The bug affected every version back to 4.7.0. That’s nearly a decade of releases, and nobody needs an account to trigger it. Robert Ressl gets credit for reporting it.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by September 24, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do.

The post WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution appeared first on TechRepublic.