Is CVE-2026-119977 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-119977

Organizations should apply the latest WordPress Core security updates to mitigate CVE-2026-119977. Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets per BOD 26-04 and must check for evidence of pre-compromise before applying patches. All organizations are encouraged to adopt risk-based vulnerability management practices and prioritize remediation of KEV-listed vulnerabilities on publicly exposed systems.

Quick answers

What is CVE-2026-119977?: Organizations should apply the latest WordPress Core security updates to mitigate CVE-2026-119977. Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets per BOD 26-04 and must check for evidence of pre-compromise before applying patches. All organizations are encouraged to adopt risk-based vulnerability management practices and prioritize remediation of KEV-listed vulnerabilities on publicly exposed systems.
How severe is CVE-2026-119977?: high
Is CVE-2026-119977 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-119977 be mitigated?: Organizations should apply the latest WordPress Core security updates to mitigate CVE-2026-119977. Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets per BOD 26-04 and must check for evidence of pre-compromise before applying patches. All organizations are encouraged to adopt risk-based vulnerability management practices and prioritize remediation of KEV-listed vulnerabilities on publicly exposed systems.

CVSS

—

Vendor

WordPress

Published

Nov 4, 2026 · 02:28

Patch

Unknown / not confirmed

Affected products

WordPress Core

Mitigation

CISA Adds WordPress Core TOCTOU Race Condition to Known Exploited Vulnerabilities Catalog

On November 3, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability affects WordPress Core and is classified as a Time-of-check Time-of-use (TOCTOU) Race Condition. CISA cited evidence of active exploitation in the wild. The inclusion triggers requirements under Binding Operational Directive (BOD) 26-04 for Federal Civilian Executive Branch agencies to prioritize rapid remediation on publicly exposed assets and to check for pre-compromise before patching. CISA encourages all organizations to adopt similar risk-based prioritization.

12m

CVE-2026-119977

Quick answers

Related News

CISA Adds WordPress Core TOCTOU Race Condition to Known Exploited Vulnerabilities Catalog