Covered by 2 outlets — first reported by CISA Advisories, Nov 3, 12:00 UTC
CISA Adds One Known Exploited Vulnerability to Catalog
MentionsWordPress
Summary
CISA added a flaw in WordPress Core, tracked as CVE-2026-119977, to its Known Exploited Vulnerabilities catalogue on November 3, citing evidence of active exploitation. The flaw is a race condition (a timing weakness) that allows remote code execution, and affects WordPress versions 4.7 through 7.1.3. NVD scores it 8.1 on the CVSS scale. CISA's listing carries a federal due date of November 6.
AI summary by the SecurityTabs newsroom, checked against CISA Advisories, Security Affairs. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
CISA AdvisoriesFirst report
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
Security Affairs
U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog. The U.S.
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.