The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code
CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CISA Warns of WordPress Vulnerability Exploited in the Wild (CVE-2026-119977)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a WordPress core vulnerability to the Known Exploited Vulnerabilities catalog. CISA urges…
NCSC-2026-0466 [1.00] [L/H] Kwetsbaarheid verholpen in WordPress Core
WordPress heeft een kwetsbaarheid verholpen in WordPress Core versies 4.7 tot en met 7.1.3. De kwetsbaarheid maakt misbruik mogelijk van een TOCTOU-racecondition…
U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog. The U.S.
WordPress security advisory (AV26-1117)
Serial number: AV26-1117 Date: November 3, 2026 As of October 31, 2026, WordPress is affected by a vulnerability in the following product: WordPress Core Prior to 7.1.4…
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-119977 WordPress Core…
CISA flags WordPress RCE flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress…