CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

CISA added a high-severity TOCTOU race condition vulnerability in WordPress Core, tracked as CVE-2026-119977 with a CVSS score of 8.1, to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated remote code execution during the upgrade window by targeting predictable web-accessible staging paths. Security telemetry shows thousands of active exploitation attempts targeting vulnerable instances worldwide.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module identifies internet-accessible web services and extracts exposed application banners, matching the running WordPress version against known vulnerability databases like CVE-2026-119977.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain