The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-119977, a flaw in WordPress core, to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of exploitation. It is a high-severity (CVSS 8.1) time-of-check time-of-use race condition: according to CISA, a full WordPress core upgrade creates predictable, web-accessible staging paths, and an unauthenticated attacker can use them to execute code on the server.
Security firm Wordfence, which published the details last week, said exploitation needs no account on the site but works only during the brief window of a full core update. It said it recorded more than 18,500 requests to the installer paths in the first 21 hours after disclosure, and blocked 12,632 exploitation attempts within 24 hours. The first attempts were seen as early as October 30.
What to do: the fix was released in late October, and anyone running a WordPress site should make sure it is already on the patched version. US federal civilian agencies have until November 6 to apply it.