CISA adds WordPress Core race-condition flaw CVE-2026-119977 to KEV catalog

Summary

CISA has added CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The federal directive BOD 26-04 requires federal civilian agencies to prioritize remediating listed vulnerabilities on publicly exposed assets.

What to do

• Update WordPress core to the latest patched release.

• Check the WordPress vendor advisory for CVE-2026-119977 and confirm which versions are affected.

• Review sites for signs of unauthorized changes or new admin accounts.

Timeline

1. Nov 3, 2026, 12:00 PM UTCMade public by CISA advisories
2. Nov 3, 2026, 8:44 PM UTCFirst seen by cve.now
3. Nov 3, 2026, 9:16 PM UTCConfirmed by CISA advisories1 day
4. Nov 4, 2026, 1:08 AM UTCRecord last updated

Evidence 5

1. Nov 3, 2026Official
   CISA advisories

   “CISA Adds One Known Exploited Vulnerability to Catalog”

2. Nov 3, 2026Social
   Mastodon

   “⚠️ FAILLE CRITIQUE CVE-2026-119977 activement exploitée : WordPress Core – Condition de concurrence « Time-of-check Time-of-use » (TOCTOU)”

3. Nov 3, 2026Social
   Bluesky

   “Newly listed by CISA: WordPress WordPress Core WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability”

4. Nov 3, 2026Social
   Mastodon

   “CISA lists this as actively exploited, so treat it as urgent.”

5. Nov 3, 2026Social
   Mastodon

   “CISA added WordPress Core CVE-2026-119977 to KEV on Nov. 3.”

   +1 more: Mastodon

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.