ChordNews
← All news

CISA Adds High-Severity WordPress Core Flaw CVE-2026-119977 to KEV Catalog Over Active Exploitation

By ChordNews · First written (new coverage , updated )

CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
Image: thehackernews.com
Comments 0

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity WordPress Core flaw, tracked as CVE-2026-119977 (CVSS score: 8.1), to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The Hacker News reports that the flaw is a Time-of-check Time-of-use (TOCTOU) race condition, though its excerpt is cut off before describing the impact. BleepingComputer reports that CISA warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. The source excerpts do not give affected versions, patch dates or further technical details.

This continues an earlier story: WordPress Core RCE Flaw Draws Nearly 63,000 Attack Attempts in 24 Hours

Later: CISA Adds Flaws in OpenSSH, GPUStack, FreeSWITCH and IBM Aspera Faspex to KEV Catalog Over Active Exploitation

Timeline

  1. The Hacker News

    Source ↗

    The Hacker News reports that CISA has added a high-severity WordPress Core TOCTOU race condition flaw, tracked as CVE-2026-119977 with a CVSS score of 8.1, to its KEV catalog, citing evidence of active exploitation.

  2. BleepingComputer

    Source ↗

    BleepingComputer reports that CISA warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild.

Comments

No comments yet.

    to like and comment.

    © 2026 ChordNews