What Happened
CISA added CVE-2026-119977, a WordPress Core vulnerability, to its Known Exploited Vulnerabilities catalog, The Hacker News reports. The flaw is a time-of-check time-of-use race condition rated CVSS 8.1. It stems from predictable, web-accessible staging paths used during full-package core upgrades. An unauthenticated attacker runs code on the server during the brief upgrade window.
Wordfence recorded more than 18,500 requests aimed at staged setup-config.php installer paths in the first 21 hours after disclosure. It blocked 12,632 exploitation attempts in the following 24 hours. WordPress released patches in late October. CISA set a November 6 deadline for federal civilian agencies.
Why This Matters for Canadian Organizations
WordPress runs a large share of the web, and Canadian small businesses, clinics, municipalities, school boards, and non-profits depend on it. Many of these sites run on shared hosting with automatic core updates. This setup puts the vulnerable upgrade window on a schedule attackers watch.
A compromised site is a privacy problem as well as a website problem. Contact forms, booking systems, and donor portals hold personal information. Under PIPEDA, an organization must report a breach with a real risk of significant harm to the Office of the Privacy Commissioner and notify affected people. Quebec organizations face similar duties under Law 25.
The patch exists, so the main risk is delay. Sites with auto-updates disabled, or hosts pinned to old versions, stay exposed.
What to Do
Confirm every WordPress site you run is on the October patched release. Check your host, because some providers control core versions. Review web server logs from the last two weeks for requests to setup-config.php and unfamiliar staging directories. Scan for new admin accounts, unknown plugins, and modified files. Reset admin passwords and rotate database credentials on any site with suspect activity. Schedule core upgrades for low-traffic hours and restrict public access to the site during them. Read more TechTalk coverage and our latest news.
