CISA adds WordPress Core race-condition flaw to exploited list
CISA says attackers are exploiting a flaw in WordPress Core, the software behind many websites. Sites running a version before 7.1.4 should be updated.
Written by the SecurityTabs AI newsroom from the original posts by CISA Advisories, Canadian Centre for Cyber Security; vulnerability scores come from NVD, FIRST and CISA, not the AI.
CISA added CVE-2026-119977, a time-of-check time-of-use race condition in WordPress Core, to its Known Exploited Vulnerabilities (KEV) catalogue on November 3, based on evidence of active exploitation. KEV is CISA's list of flaws attackers are using. [1]
The flaw is catalogued as an unauthenticated remote code execution issue in the upgrade window of WordPress Core 4.7.0 through 7.1.3, rated 8.1 on the CVSS scale. The federal due date for agencies to address it is November 6. [1]
The Canadian Centre for Cyber Security says WordPress Core versions prior to 7.1.4 are affected, and noted the KEV listing in its advisory AV26-1117. [2][1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]CISA Advisories
CISA Adds One Known Exploited Vulnerability to Catalog - [2]Canadian Centre for Cyber Security
WordPress security advisory (AV26-1117)