CriticalVulnerabilityNov 3, 2026

WordPress Core TOCTOU flaw added to CISA KEV

WordPress Core contains a time-of-check time-of-use race condition vulnerability allowing unauthenticated remote code execution during upgrade windows via predictable staging paths. CISA added it to the Known Exploited Vulnerabilities catalog with a federal patching deadline of November 6, 2026. Administrators must apply patches immediately and evaluate internet exposure per BOD 26-04 guidance.

Vulnerabilities

CVE-2026-119977 CVSS 8.1 EPSS 0.6% Exploited (CISA KEV)

Sources

CISA KEVRead the original article
BleepingComputerRead the original article

AI-written summary. Check the original reporting before acting.