CISA Says a WordPress Core Flaw Is Being Exploited: What to Do Today

On November 4, 2026, CISA added a WordPress Core vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. That means attackers are already using it in the wild.

What we know

• The flaw is in WordPress Core, not in a plugin.
• Wordfence reported that exploiting it does not require an account on the site.
• It relates to predictable, web-accessible staging paths used during full-package core upgrades.
• A fix has already been released.

What to do today

1. Update WordPress core to the latest security release.
2. Check your logs for strange requests, especially around upgrade time.
3. Confirm your backups work by restoring one on a test server.
4. Turn on automatic security updates if your setup allows it.
5. Review file permissions and remove leftover upgrade files.

The bigger lesson

A patch only protects you after you install it. The gap between "fix released" and "fix installed" is where most attacks happen.

If you manage many sites, track every site's core version in one place, so you can see in minutes which ones are behind.

Question for you

How soon do you update after a security release: the same day, this week, or later? Tell me in the comments.

Sources: The Hacker News and BleepingComputer, November 4, 2026.