CISA adds WordPress TOCTOU vulnerability to KEV Catalog
Original title: CISA Adds One Known Exploited Vulnerability to Catalog
CISA adds CVE-2026-119977, a TOCTOU race condition in WordPress Core, to KEV Catalog based on active exploitation.
CISA has added CVE-2026-119977 to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation. This vulnerability is a time-of-check time-of-use race condition in WordPress Core and poses risks to federal enterprise. Federal agencies must prioritize remediation under BOD 26-04.
- CVE-2026-119977 added to KEV Catalog
- Type: TOCTOU race condition in WordPress Core
- Active exploitation confirmed
- BOD 26-04 requires federal agencies to prioritize patching
Impact: Unauthorized access via race condition in WordPress Core
| Product | Affected |
|---|---|
| WordPress Core | affected by TOCTOU |
- 1.Prioritize remediation per BOD 26-04
- 2.Check for system compromise before patching
- CVEs
- CVE-2026-119977
- Vendors
- WordPress
- Products
- WordPress Core
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |
From the original article
1 min read at cisa.govCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.