Our automated tracking framework flagged that CISA added CVE-2026-119977 (WordPress WordPress Core) to the Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-119977 by November 6, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-119977 |
| Vendor / product | WordPress WordPress Core |
| Vulnerability | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability |
| CVSS base score | 8.1 |
| Added to KEV | November 3, 2026 |
| Days public before listing (NVD → KEV lag) | 3 |
| Federal patch deadline | November 6, 2026 |
| Known ransomware use | No |
How This Compares to WordPress’s Track Record
This one was public for just 3 days before CISA confirmed exploitation — faster than WordPress’s 4-day median, meaning attackers moved unusually quickly.
| WordPress in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 7 |
| Median lag (public → KEV listing) | 4 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1767 tracked KEV entries is 232 days — WordPress’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent WordPress KEV Additions
The most recent WordPress vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-87902 | Core | September 25, 2026 | 3 | No |
| CVE-2026-60137 | Core | July 21, 2026 | 4 | No |
| CVE-2026-63030 | Core | July 21, 2026 | 4 | No |
| CVE-2020-25213 | File Manager Plugin | November 3, 2021 | 420 | No |
| CVE-2019-9978 | Social Warfare Plugin | November 3, 2021 | 955 | No |
What This Means for Defenders
CISA has added CVE-2026-119977, a critical vulnerability in WordPress WordPress Core, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 8.1, it’s a significant risk requiring immediate attention. Federal agencies must apply patches by November 6, 2026. This urgency extends to all organizations using WordPress, particularly those with public-facing instances or high-value data.
The short NVD-to-KEV lag of just 3 days indicates active exploitation was detected very quickly after public disclosure. It shows attackers are highly motivated and proficient at weaponizing this flaw. While ransomware use isn’t currently known, the quick exploitation suggests a wide range of potential attack scenarios.
Organizations unable to apply the patch before the federal deadline should immediately implement compensating controls. Restrict access to the WordPress administration interface, deploy Web Application Firewalls (WAFs) to detect and block suspicious requests, and enhance monitoring for unusual activity within WordPress environments. Prioritizing patching remains the most effective mitigation.
Related Coverage
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
- WordPress’s CVE-2026-87902 Was Exploited in 3 Days — Well Under Its 212-Day Median (September 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
