CISA has added CVE-2026-119977, a time-of-check time-of-use (TOCTOU) race condition in WordPress Core, to its Known Exploited Vulnerabilities catalog after confirming active exploitation, and federal agencies must act by November 6, 2026.
What Is It
CVE-2026-119977 is a race condition vulnerability (CWE-367) in WordPress Core. Wordfence reported it, and the NVD record was published on October 31, 2026. During full-package core upgrades, WordPress uses staging paths that are predictable and reachable from the web. While an upgrade is running, an unauthenticated attacker can use those paths to execute code on the server.
Wordfence rates it CVSS 3.1 8.1 (HIGH) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack works over the network and needs no privileges or user interaction. Attack complexity is rated High because the attacker must hit the upgrade window.
Why It Matters
CISA added this flaw to the KEV catalog on November 3, 2026, which confirms active exploitation. CISA's SSVC assessment lists exploitation as "active," technical impact as "total," and automatable as "no." Use in ransomware campaigns is currently listed as "Unknown."
The KEV entry also has Forensic Triage: Yes. Organizations should follow CISA's Forensics Triage Requirements in addition to patching. A successful attack gives unauthenticated code execution on the web server, with high impact to confidentiality, integrity, and availability.
What's Vulnerable
NVD lists WordPress Core versions 4.7 through 7.1.3 as affected. The affected ranges by branch include:
- 4.7.0–4.7.38, 4.8.0–4.8.33, 4.9.0–4.9.34
- 5.0.0–5.0.30 through 5.9.0–5.9.19
- 6.0.0–6.0.17 through 6.9.0–6.9.10
- 7.0.0–7.0.7
- 7.1.0–7.1.3
Exposure happens during full-package core upgrades, while the staging paths exist.
Patch Status
The vendor's references point to WordPress 7.1.4 as the fixed release. NVD links to the changed upgrader code in the 7.1.4 tag.
CISA's required action is to apply mitigations according to vendor instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Cloud services should follow the applicable BOD 26-04 guidance. If mitigations are unavailable, stop using the product. Stakeholders must evaluate each asset's internet exposure. The federal remediation due date is November 6, 2026.
The NVD record is still marked "Undergoing Analysis."