Skip to main navigation Skip to main content Skip to page footer

Security Alert: WordPress Security Update - October 2026 | Remote Code Execution Vulnerabilities in Node.js

Data Protection Office
Contact us Report an incident
Data Protection Office
Contact us Report an incident

 

About us

The mission of the National Cyber Security Authority (NCSA) is to build skills and capabilities necessary to secure Rwanda’s cyberspace in order to sustain economic and social development. Specifically, NCSA oversees the following areas

Cyber Defense and Resilience

24/7 Prevention, Threat monitoring and Incident Response

 

Cybersecurity Standards

Develop cybersecurity policies and strategies to ensure cyber resilience

 

Data Protection and Privacy

Enforce Rwanda’s Law on Personal Data Protection and Privacy

 

Cybersecurity coordination

We collaborate with partners to ensure a secure cyberspace

 

Read more

Cybersecurity News & Insights

Security Alert: WordPress Security Update - October 2026

Wordfence has released security updates for WordPress Core, plugins, and themes to address multiple vulnerabilities, including the high‑severity CVE-2026-119977 in WordPress Core, which enables attackers to run arbitrary code on servers without authentication.

Affected Systems:

The affected systems and versions include, but are not limited to:

  • WordPress Core: versions prior to 7.1.4

  • WordPress Plugins: 

    • addon elements for Elementor page builder: versions prior to 1.14.5

    • WP Directory Kit: versions prior to 1.6.1

  • WordPress Theme :

    • Avada Website Builder For WordPress & WooCommerce: versions prior to 7.16.4

Security Risks

Exploitation of these vulnerabilities can enable arbitrary code execution, privilege escalation, or script injection, resulting in site compromise, data exposure, and operational disruption.

 

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

  • Update as soon as possible to the latest supported versions of all affected WordPress components to address known vulnerabilities and reduce the risk of exploitation.

   The WordPress components versions available for upgrade include, but are not limited to:

  • WordPress Core: Upgrade to version 7.1.4 or above

  • Wordpress Plugins:

  • Wordpress Theme:

    • Avada Website Builder For WordPress & WooCommerce: Upgrade to version 7.16.4 or above

  • Before updating or patching, please ensure that you have the latest backup that can easily be restored. 

For further information and support, please contact the National Cyber Security Authority (NCSA) by email to rwcsirt@ncsa.gov.rw or call us on 9009.

References

Security alerts

Security Alert: WordPress Security Update - October 2026

Wordfence has released security updates for WordPress Core, plugins, and themes to address multiple vulnerabilities, including the high‑severity CVE-2026-119977 in WordPress Core, which enables attackers to run arbitrary code on servers without authentication.

Affected Systems:

The affected systems and versions include, but are not limited to:

  • WordPress Core: versions prior to 7.1.4

  • WordPress Plugins: 

    • addon elements for Elementor page builder: versions prior to 1.14.5

    • WP Directory Kit: versions prior to 1.6.1

  • WordPress Theme :

    • Avada Website Builder For WordPress & WooCommerce: versions prior to 7.16.4

Security Risks

Exploitation of these vulnerabilities can enable arbitrary code execution, privilege escalation, or script injection, resulting in site compromise, data exposure, and operational disruption.

 

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

  • Update as soon as possible to the latest supported versions of all affected WordPress components to address known vulnerabilities and reduce the risk of exploitation.

   The WordPress components versions available for upgrade include, but are not limited to:

  • WordPress Core: Upgrade to version 7.1.4 or above

  • Wordpress Plugins:

  • Wordpress Theme:

    • Avada Website Builder For WordPress & WooCommerce: Upgrade to version 7.16.4 or above

  • Before updating or patching, please ensure that you have the latest backup that can easily be restored. 

For further information and support, please contact the National Cyber Security Authority (NCSA) by email to rwcsirt@ncsa.gov.rw or call us on 9009.

References

Documentation

Law relating to the protection of personal data and privacy

see more

Minimum cybersecurity standards for essential service providers

see more

Information Security Policy Template

see more

Application Software Security Directives

see more
Read more

Our Focus Areas

24/7 Incident Response

To prevent cyber-incidents, NCSA through Rw-CSIRT, provides 24/7 incident response in order to contain the situation, minimize damage and draw lessons for future preventions.

National Cybersecurity and Data Protection Awareness

We disseminate materials and organization awareness campaigns to educate the public on best practices to keep themselves safe online.

Critical Infrastructure Protection

NCSA monitors and protects critical information infrastructure of Rwanda’s key sectors.

Threat Monitoring and Research

Through Rw-CSIRT, NCSA provides 24/7 threat monitoring while also conducting research on stay updated with the latest trends in cybersecurity. 

Policy & Regulation

Developing and enforcing policies to strengthen the national cybersecurity framework

International Cooperation

Collaborating with global partners to combat transnational cybercrime.

Partners