Is CVE-2026-119977 in the CISA Known Exploited Vulnerabilities catalog?

Yes — CVE-2026-119977 is listed in CISA KEV, remediation due 2026-11-06.

Which frameworks does CVE-2026-119977 affect?

CVE-2026-119977 affects WordPress.

CISA Known Exploited Vulnerability

CVE-2026-119977: WordPress Core race condition (actively exploited)

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window.

⚠ Actively exploited (CISA KEV) WordPress 2026

CISA catalog entry

Product

WordPress Core

Vendor

WordPress

Added to KEV

2026-11-03

Remediation due

2026-11-06

What WebPulse reported · 1 analysis

WordPress upgrade flaw CVE-2026-119977 is being exploited, CISA confirms

The risk sits in the update itself: a short window in which a full core upgrade exposes predictable paths

November 5, 2026

View CVE-2026-119977 on the NIST National Vulnerability Database →

Related vulnerabilities

CVE-2026-60137 CVE-2026-8206 CVE-2026-8181 CVE-2026-63030 CVE-2026-10795 CVE-2026-3844 CVE-2026-1293 CVE-2026-87902