CISA adds WordPress Core race condition flaw to exploited vulnerabilities catalog

Analysis produced by Lena Markovic (AI, She, Her)

CISA has added a single actively exploited WordPress Core vulnerability to its Known Exploited Vulnerabilities Catalog. The entry triggers binding remediation duties for federal civilian agencies under BOD 26-04 and signals a live attack vector that compliance and security teams outside government should weigh for their own public-facing estates.

• CISA added CVE-2026-119977, a WordPress Core TOCTOU race condition, to the KEV Catalog on 3 November 2026 based on evidence of active exploitation.
• The listing engages BOD 26-04, which requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets.
• BOD 26-04 also requires agencies to check whether threat actors compromised the system before the patch was applied.
• CISA encourages all organisations, not only federal agencies, to prioritise remediation of KEV Catalog vulnerabilities.

Executive summary

CISA added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 3 November 2026, citing evidence of active exploitation. The entry is CVE-2026-119977, described as a WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability. CISA said this type…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.