Skip to content
ThreatCluster

CISA Adds High-Risk WordPress Vulnerability to KEV Catalog

First seen 4 Nov 2026, 12:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 4, 2026 at 12:18 UTC
  • •CVE-2026-119977 added to CISA's KEV Catalog due to active exploitation.
  • •The vulnerability affects WordPress and poses significant risks to federal agencies.
  • •BOD 26-04 mandates rapid remediation of high-risk vulnerabilities for federal entities.

CISA has added CVE-2026-119977, a WordPress Core Time-of-check Time-of-use (TOCTOU) race condition vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This vulnerability is a common attack vector for malicious actors and poses significant risks to federal agencies. Under Binding Operational Directive (BOD) 26-04, federal agencies are required to prioritize the rapid remediation of high-risk vulnerabilities listed in the KEV Catalog, particularly those that could grant total control of affected assets post-exploitation. While BOD 26-04 specifically targets Federal Civilian Executive Branch agencies, CISA encourages all organizations to adopt similar risk-based vulnerability management practices. CISA will continue to update the KEV Catalog as new vulnerabilities are identified and confirmed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-31
CVE-2026-119977 published
The WordPress Core TOCTOU race condition vulnerability was published, assigned CVSS 8.1 HIGH.
Cisa
2026-11-03
CISA adds CVE-2026-119977 to KEV Catalog
CISA confirmed active exploitation of the vulnerability and added it to the KEV Catalog.
Cisa

More articles in this cluster (2)

Following this threat?

Track CVE-2026-119977 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

What is CVE-2026-119977?
CVE-2026-119977 is a TOCTOU race condition vulnerability in WordPress that can be exploited by attackers.
How urgent is the response to this vulnerability?
The vulnerability is actively exploited, making it critical for affected organizations to remediate it immediately.
What should organizations do to protect against this vulnerability?
Organizations should prioritize applying security updates and follow CISA's guidance on vulnerability management.