CISA confirms WordPress upgrade flaw is under active exploitation

The flaw lets unauthenticated attackers execute code during full-package upgrades, and the first update to the fixed release can still leave sites exposed.

RuntimeWire · 2026-11-04T20:51:39.962Z