Today, attackers are targeting a race condition vulnerability in WordPress, which could allow them to execute code on your server. Small businesses using WordPress should be particularly vigilant.
WordPress WordPress Core (CVE-2026-119977)
WordPress WordPress Core. This product is the core platform used by WordPress websites. An attacker can exploit this vulnerability by taking advantage of predictable staging paths during upgrades, potentially allowing them to execute malicious code. To protect your business, ensure your WordPress installation is up to date and consider using security plugins and regular backups.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Switch on two-step sign-in
Email, banking and Microsoft 365 or Google accounts first. A stolen password alone is then not enough to get in.
Doing it once, properly
Cheaper is usually more expensive in the long run: a rushed or bargain setup is often done again from the start, and you pay twice, plus whatever the breach in between cost.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-119977 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.