CISA Adds WordPress Core TOCTOU Vulnerability to KEV List

## Overview CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) list on November 3, 2026. This vulnerability affects WordPress Core versions 4.7 through 7.1.3. It allows unauthenticated attackers to execute remote code during the upgrade process. The timing of the KEV addition suggests an increase in exploitation attempts. ## Technical Details The vulnerability is a time-of-check time-of-use (TOCTOU) race condition. It arises from predictable, web-accessible staging paths used during full-package core upgrades. Attackers can exploit this flaw by initiating a race condition, allowing them to execute arbitrary code on the server while the upgrade is in progress. This issue is particularly critical because it does not require authentication, making it easier for attackers to exploit. ## Impact Successful exploitation of CVE-2026-119977 can lead to full server compromise. Attackers can gain control over the affected WordPress installation, potentially leading to data breaches, website defacement, or further attacks on connected systems. The CVSS score of 8.1 indicates a high severity level, emphasizing the urgency of addressing this vulnerability. ## Mitigation WordPress administrators should update their installations immediately to versions beyond 7.1.3. Regularly monitor for updates and apply security patches as they are released. Additionally, consider implementing web application firewalls (WAFs) to help mitigate potential exploitation attempts during the upgrade window. Regularly review server configurations to minimize exposure to predictable staging paths.