What happened

On November 3, 2026, CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities (KEV) catalog as "WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability," based on evidence of active exploitation. CISA's description: "WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades."

NVD scores it CVSS 3.1 8.1 and classifies it as CWE-367.

CISA's required action for federal agencies: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." The remediation due date is November 6, 2026, 3 days after the listing. CISA lists ransomware use as unknown.

CISA's entry does not say who is exploiting the flaw or since when. The affected releases, fixes and any workaround are in the vendor advisory linked under Sources.

Why it matters if you run public infrastructure

A KEV listing means exploitation has been observed, not predicted. WordPress Core is commonly exposed to the internet, and internet-facing installs are the first to be found and exploited once a flaw is public.

What to check this week

  1. List every WordPress Core instance reachable from the internet, including appliances or servers kept for a migration and interfaces on non-standard ports.
  2. Check the installed version. WordPress: see Dashboard, Updates in the WordPress admin. NVD lists versions before 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25 as affected; confirm the fixed release for your branch in the vendor advisory linked under Sources.
  3. Apply the fix. Follow CISA's required action quoted above. The upgrade or mitigation steps are in the vendor advisory linked under Sources.
  4. Look for signs of compromise if the system was exposed before you patched. Check the vendor advisory linked under Sources for published indicators, and review the system's logs from before the patch.
  5. Ask whether it needs to be public at all. An allowlist or VPN in front of a management interface turns the next flaw in it from an emergency into a routine patch.

How Attack Surface Scan covers this

Attack Surface Scan recognizes WordPress from the page it serves on hosts under your verified domains, including hosts found through certificate transparency logs. Where the version is visible, the match is against that exact version using NVD's affected ranges, and KEV-listed CVEs like this one are ranked first. When the version is hidden, we report the product but do not guess which CVEs apply. We do not send exploit payloads. See Vulnerability matching for the details.

This alert was published automatically from the CISA KEV and NVD records within hours of the listing, and says only what those records and our scan catalog state. The vendor advisory linked under Sources has the full details.

Sources