CISA Confirms Active Exploitation of WordPress Core Vulnerability (CVE-2026-119977)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity WordPress Core vulnerability (CVE-2026-119977) to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The flaw is a Time-of-check Time-of-use (TOCTOU) race condition that could allow unauthenticated attackers to achieve arbitrary code execution during software upgrades. Federal Civilian Executive Branch agencies are mandated to apply patches by November 6, 2026.