# SZB-e57f3ab75f: CISA adds WordPress Core race-condition flaw CVE-2026-119977 to KEV catalog

CISA has added CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.

- Type: Early warning
- Kind: Vulnerability
- Vendor: WordPress
- Product: WordPress Core
- Status: Confirmed
- Sources: 5 distinct
- First seen: 2026-11-03 20:44 UTC
- Confirmed: 2026-11-03 21:16 UTC

Written by a model from the sources below. Verify against them.

## Summary

CISA has added CVE-2026-119977, a WordPress Core time-of-check time-of-use race condition, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The federal directive BOD 26-04 requires federal civilian agencies to prioritize remediating listed vulnerabilities on publicly exposed assets.

## What to do

- Update WordPress core to the latest patched release.
- Check the WordPress vendor advisory for CVE-2026-119977 and confirm which versions are affected.
- Review sites for signs of unauthorized changes or new admin accounts.

## Timeline

- 2026-11-03 12:00 UTC: Made public by CISA advisories
- 2026-11-03 20:44 UTC: First seen by cve.now
- 2026-11-03 21:16 UTC: Confirmed by CISA advisories
- 2026-11-04 01:08 UTC: Record last updated

## Evidence (5 sources)

- 2026-11-03 · Official · [CISA advisories](https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog): “CISA Adds One Known Exploited Vulnerability to Catalog”
- 2026-11-03 · Social · [Mastodon](https://infosec.exchange/@infonewscyber/117554452123005163): “⚠️ FAILLE CRITIQUE CVE-2026-119977 activement exploitée : WordPress Core – Condition de concurrence « Time-of-check Time-of-use » (TOCTOU)”
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/patchsonar.com/post/3mzgszqw4522d): “Newly listed by CISA: WordPress WordPress Core WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability”
- 2026-11-03 · Social · [Mastodon](https://infosec.exchange/@patchsonar/117554716103237591): “CISA lists this as actively exploited, so treat it as urgent.”
- 2026-11-03 · Social · [Mastodon](https://infosec.exchange/@cyberseckyle/117554991810261977): “CISA added WordPress Core CVE-2026-119977 to KEV on Nov. 3.” (+1 more: [Mastodon](https://infosec.exchange/@Secquill/117555485646642115))

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-e57f3ab75f&body=https%3A%2F%2Fcve.now%2FSZB-e57f3ab75f%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-e57f3ab75f

### Has WordPress confirmed it?

Yes. Confirmed by CISA advisories.

Source: https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog, https://infosec.exchange/@infonewscyber/117554452123005163, https://bsky.app/profile/patchsonar.com/post/3mzgszqw4522d, https://infosec.exchange/@patchsonar/117554716103237591, https://infosec.exchange/@cyberseckyle/117554991810261977

### What should WordPress users do?

Update WordPress core to the latest patched release. Check the WordPress vendor advisory for CVE-2026-119977 and confirm which versions are affected. Review sites for signs of unauthorized changes or new admin accounts.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-119977.

Source: https://cve.now/CVE-2026-119977

## Tracked as

- [CVE-2026-119977](https://cve.now/CVE-2026-119977.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-e57f3ab75f
Site guide for agents: https://cve.now/llms.txt