CISA just confirmed that attackers are actively exploiting a flaw buried deep in WordPress core — one that can let a stranger take over your website while it's running an update. If your business runs a WordPress site (and roughly 40% of the web does), this is a this-week problem, not a next-quarter problem.
What happened
On November 3, the U.S. Cybersecurity and Infrastructure Security Agency added a WordPress core vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming that criminals are already using it in the wild. Tracked as CVE-2026-119977, the vulnerability affects the updater's handling of temporary installation files and can allow remote code execution without an account on the targeted site.
In plain English: an attacker who catches your site during a core WordPress update can slip in and run their own code — no password, no login, no user account required. The bug was found by Umut Bayram, a security researcher at Picus Security, carries a CVSS score of 8.1, and was added to CISA's Known Exploited Vulnerabilities catalog on November 3.
For applicable federal systems, CISA set November 6 as the remediation deadline and listed forensic triage as required under Binding Operational Directive 26-04. Its exploitation warning does not identify the attackers or disclose how many websites have been compromised. When CISA puts a deadline that tight on a federal patch, that's the agency's signal that private-sector organizations should move at the same pace.
Why small businesses should care
WordPress isn't an enterprise problem — it's a small-business problem. Local restaurants, law firms, contractors, dentists, and nonprofits across York County run WordPress for their public website, their online store, their booking system, or their customer portal. A compromised WordPress site typically gets used for one of four things: planting malware that infects your visitors, stealing customer data entered into forms, redirecting your traffic to scam sites, or quietly staging attacks against your other systems.
The mechanics of this flaw make it especially nasty for lightly-managed sites. The update process itself is the attack window — meaning the very maintenance activity you're supposed to do to stay safe is what creates the opening. Sites on cheap shared hosting, sites that auto-update without monitoring, and sites nobody has logged into in months are all at elevated risk.
What your IT provider should be doing this week
If you have a managed-IT or managed-security provider, this story is a good test of whether they're actually watching. Here's the short list you should expect them to work through:
- Inventory every WordPress site tied to your business — main site, marketing microsites, old campaign pages, staff blogs, client portals. Shadow sites are where this bug will bite hardest. - Confirm each site is running the patched WordPress core version. WordPress has released fixes; the job is making sure they're actually installed, not just available. - Review the updater and file-system logs for signs of exploitation during recent update cycles. CISA explicitly called forensic triage a requirement, not a suggestion. - Lock down file permissions on wp-content and the WordPress root so that even a successful exploit has less room to work. - Make sure your site has a current, offline backup you've actually tested restoring from — not just a backup plugin you installed two years ago.
If you don't have a provider doing this kind of edge-case vulnerability triage for you, that gap is exactly what York Computer's managed IT and cybersecurity services are built to close. For businesses that already have an internal IT person handling day-to-day work, co-managed IT support can add the vulnerability-monitoring and after-hours response muscle most small teams don't have on their own.
The bigger pattern
This is the second CISA KEV listing in recent weeks aimed squarely at software small businesses actually run. The pattern is consistent: attackers are hunting for the devices and platforms that live outside of enterprise security tooling — WordPress sites, edge firewalls, small-business VPNs, switches in wiring closets. If your security posture depends on hoping nobody notices your website, that strategy expired on November 3.
What York Businesses Should Do
York County businesses with a WordPress site should ask their web host or IT provider — this week — whether their site is patched to the fixed version of WordPress and whether anyone has reviewed update logs for signs of compromise. If the answer is a shrug, that's your problem to solve before the holiday shopping and year-end billing push.