Updating WordPress Sites to Fix Active Vulnerability Can Still Trigger Exploitation

The Hacker News reported that WordPress administrators face a temporary security risk while applying a fix for an actively exploited vulnerability. Umut Bayram, a security researcher at Picus Security who discovered the issue, stated that some WordPress sites remain vulnerable to attacks while installing the security update. Cyber Kendra separately identified the issue as CVE-2026-119977 affecting WordPress version 7.1.4. [1][4]

The Hacker News reported that the update mechanism unpacks its files using the site's existing, unpatched code. Because the old code remains active until the installation completes, an attacker who launches an exploit at the exact moment of updating can achieve remote code execution, according to both The Hacker News and Cyber Kendra. [1][4]

October 2026 has been referred to in information security as Black October following a wave of major security incidents and vulnerability disclosures. Security researchers attributed the high volume of disclosures to the growing use of artificial intelligence in vulnerability discovery, which has created new challenges for widely deployed software and internet infrastructure. [5]

In a separate development, CISA Alerts announced that CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog. According to CISA Alerts, the flaw involves single-factor authentication usage in SonicWall SonicOS SSLVPN devices. Federal agencies must patch the targeted flaw under Binding Operational Directive 26-04. [2]