WordPress Is Being Actively Exploited Right Now: What UK Small Businesses Must Do Today
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on the 3rd of November 2026. That is not a theoretical risk rating or a vendor advisory. It means confirmed, observed, in-the-wild exploitation of WordPress core is happening right now.
If your business runs a WordPress website, the question is not whether this is relevant to you. The question is whether you have already been affected.
What CVE-2026-119977 Actually Does
The vulnerability is a time-of-check time-of-use (TOCTOU) race condition in WordPress core. The technical label sounds obscure. The practical implication is not.
When WordPress performs a full-package core upgrade, it uses staging paths that are predictable and web-accessible. An unauthenticated attacker, meaning someone with no username or password for your site, can exploit the brief window during which those staging files exist to execute arbitrary code on your server.
Arbitrary code execution means the attacker can run whatever they want on the machine hosting your site. Install malware. Create administrative accounts. Exfiltrate your customer database. Set the stage for ransomware deployment later. The upgrade window is short, but automated scanning tools can identify sites mid-update and act faster than any human administrator.
CISA’s required action is unambiguous: apply vendor mitigations in accordance with BOD 26-04 guidance. The patch is available. The exploitation is active. The gap between those two facts is where businesses get compromised.
Why This Hits UK Small Businesses Directly
WordPress powers a significant proportion of UK small business websites. Accountancy firms, solicitors, estate agents, independent retailers, tradespeople with booking systems: a substantial number of them are running WordPress, often on shared hosting managed by a third party.
This creates a specific accountability problem. The business owner assumes the hosting provider handles updates. The hosting provider’s terms of service may put responsibility for WordPress core updates on the customer. Neither party checks. The site sits unpatched.
There is a second dimension here. WordPress sites are frequently used as supply chain entry points. A compromised small business website can be used to serve malware to visitors, to harvest contact form submissions, or to pivot into connected systems. Your clients visiting a compromised version of your site is not a scenario that stays contained to your business.
The ICO’s position on data breaches does not include a ‘my hosting provider didn’t tell me’ exemption. If customer data is exposed because your website was running unpatched software, the notification obligation and potential enforcement action land on you.
The Synology Ransomware Problem Running in Parallel
On the same day, Synology issued an urgent warning about ransomware attacks targeting its NAS (Network Attached Storage) devices. The C3RB3R ransomware variant is being deployed via exploitation of a patched flaw in DiskStation Manager (DSM), the software that runs Synology devices.
Synology NAS units are extremely common in UK small businesses. They are used as local backup destinations, file servers, and in some cases as the primary storage for business-critical data. They sit quietly in server rooms and under desks, running outdated DSM versions because nobody has set up automatic updates or checked the management interface since the device was installed.
The pattern here is familiar. The flaw is patched. The patch is available. Businesses are not applying it. Ransomware operators are scanning for unpatched devices, finding them, and encrypting the contents.
The particularly painful version of this scenario: the Synology device is the backup. The primary data was encrypted by ransomware hitting the network. The business owner then discovers that the backup device was also encrypted by the same attack, or by a separate one exploiting the same unpatched DSM flaw. Both copies of the data are gone.
A backup that can be encrypted by ransomware is not a backup. It is a second copy of a future hostage.
What the Vulnerability Data Shows About Prioritisation
The NVD published several critical vulnerabilities in the same 24-hour window. Four separate flaws in TOTOLINK A950RG routers, all rated 9.9 out of 10, all allowing remote stack-based buffer overflow attacks. A critical flaw in Etrel INCH EV charging station management software with hard-coded default credentials. A serious arbitrary file deletion vulnerability in a WordPress plugin called BuddyPress XProfile Image Field.
The TOTOLINK and Etrel flaws are real and worth noting, but they affect specific hardware. The WordPress and Synology issues affect infrastructure that is ubiquitous in UK small business environments.
The BuddyPress XProfile Image Field vulnerability (CVE-2026-120518, CVSS 9.1) deserves a brief mention for WordPress site operators. The flaw allows arbitrary file deletion via manipulated signup metadata with no path containment checks. Any WordPress site running this plugin up to version 3.1.0 should update it immediately. Membership sites, community platforms, and any WordPress installation using BuddyPress for user profiles are in scope.
Why Patching Alone Is Not the Complete Answer
Applying the WordPress core update is the immediate action. It is not the end of the analysis.
If your site was running a vulnerable version of WordPress core during the period when active exploitation was occurring, you cannot simply patch and assume you are clean. A successful exploitation of CVE-2026-119977 may have left artefacts: new administrator accounts, modified files, injected code in theme files or the database, or web shells that persist after the vulnerability itself is patched.
Similarly, if your Synology device was running a vulnerable DSM version, patching the DSM after the fact does not undo any access that may have already occurred.
The uncomfortable truth is that for businesses that cannot say with certainty when their WordPress site was last updated, and cannot say whether exploitation occurred, the patch is a starting point for investigation, not a conclusion.
How This Gives You a Competitive Edge
Clients and procurement teams are asking security questions with increasing frequency. Being able to demonstrate that your business actively monitors government-confirmed threat intelligence (CISA KEV, NCSC advisories) and responds within the same working day is a verifiable differentiator.
It is also a Cyber Essentials requirement. Cyber Essentials mandates that high-risk and critical patches are applied within 14 days of release. A CISA KEV entry is about as clear a signal of criticality as exists. Applying it promptly is not just good practice: it is evidence of compliance with the standard that your clients may be asking you to hold.
Businesses that treat today’s advisory as a prompt for a one-time patch and then return to normal have missed the point. Businesses that use it as a prompt to establish an ongoing patch monitoring process have converted a threat into a process improvement.
Making the Case to Your Decision-Makers
Three arguments that should land, regardless of technical background:
First, the regulator has confirmed this is being exploited. CISA’s Known Exploited Vulnerabilities catalogue is not a theoretical risk register. It is a list of confirmed attacks. Remaining unpatched after a KEV entry is a documented decision to remain exposed to a known, active attack.
Second, the downside scenario is quantifiable. Website compromise leading to customer data exposure triggers ICO notification requirements and potential enforcement. Business disruption from ransomware hitting backup infrastructure can run to days or weeks of lost productivity. The cost of patching is an hour of a developer’s or hosting provider’s time.
Third, the reputational dimension is not recoverable. Clients whose data is compromised via your website, or who receive malware from a page they visited in good faith, do not remain clients. The damage to professional reputation in sectors where referral and repeat business dominate is disproportionate to the technical failure that caused it.
What to Do Before the End of Today
1. Update WordPress core immediately. Log into your WordPress admin panel. Navigate to Dashboard, then Updates. If a core update is available, apply it now. If your site is managed by a hosting provider or agency, contact them today and ask for written confirmation that the update has been applied and when.
2. Update Synology DSM. Log into your Synology DiskStation Manager interface. Go to Control Panel, then Update and Restore, then DSM Update. Apply any available updates. If you are unsure which version you are running, this is the moment to find out. Synology’s advisory is specific: update the DSM software.
3. Verify your WordPress plugins. If your site uses BuddyPress with the XProfile Image Field plugin, update it to a version above 3.1.0. While you are in the plugins section, update all plugins with available updates. Plugin vulnerabilities are as exploitable as core vulnerabilities.
4. Check your WordPress audit log for anomalies. If you have an audit log plugin installed (Wordfence, WP Activity Log, or similar), review entries from the past week for unexpected administrator account creations, file modifications, or login attempts from unusual IP addresses. If you do not have an audit log plugin, install one now so you have visibility going forward.
5. Confirm your backup is genuinely isolated. If your Synology NAS is both on the same network as your primary systems and accessible from those systems, ransomware can reach it. A backup that can be encrypted alongside the data it is backing up is not a recovery option. Ask your IT provider or MSP whether your backup destination is network-isolated, air-gapped, or uses immutable storage. Get a straight answer.
6. Ask your MSP or hosting provider for confirmation in writing. If someone else manages your infrastructure, send them a message today referencing CVE-2026-119977 and the Synology DSM vulnerability. Ask for confirmation that both have been patched and when. Keep the response. If they cannot confirm, that tells you something important about your managed service arrangement.
One final note: the podcast companion episode for this piece picks up the two headline items and walks through the same actions in audio. If you find that format useful, follow the show wherever you listen. A rating or review helps other business owners find it. And if you know someone running a WordPress site who hasn’t heard about this yet, share it with them today, not next week.