CISA adds WordPress Core race condition vulnerability to catalog

The Cybersecurity and Infrastructure Security Agency added a new WordPress Core security flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026. CISA Alerts reported that the action was taken after receiving evidence of active exploitation in the wild. [1]

The security flaw is identified as CVE-2026-119977 and involves a time of check to time of use race condition in WordPress Core. According to CISA Alerts, this type of vulnerability serves as a frequent attack vector for malicious hackers and creates significant risks for federal networks. [1]

A vulnerability in informational contexts refers to flaws in engineered systems that allow unauthorized access or cause failure under stress. Federal Civilian Executive Branch agencies must manage these risks under specific operational directives. [1][4]

Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are required to prioritize security updates based on risk. CISA Alerts noted that the directive establishes mandatory vulnerability management requirements to secure federal enterprise systems. [1]