WordPress's exploited upgrade flaw needs a patch and evidence review CISA confirms active exploitation of CVE-2026-119977. The vulnerable window occurs during full core upgrades; fixed releases and forensic triage address different risks.