CISA Adds Actively Exploited WordPress Core TOCTOU Race Condition Flaw to KEV Catalog
CISA has added CVE-2026-119977, a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize remediation of this vulnerability on internet-facing assets that could grant attackers total control post-exploitation, and verify whether systems were compromised prior to patching. While BOD 26-04 legally applies only to FCEB agencies, CISA urges all organizations to adopt risk-based vulnerability management and remediate this flaw promptly given its confirmed exploitation.
Entenda a falha
A vulnerabilidade
CVE-2026-119977 is a Time-of-check Time-of-use (TOCTOU) race condition in WordPress Core. CISA added it to the KEV Catalog on 2026-11-03 after confirming active exploitation in the wild. The sources do not say which component is affected, what access an attacker needs, what they gain, or which versions are affected and fixed. CISA only says patches are available and that the flaw is a frequent attack vector, so internet-facing WordPress sites should be treated as the priority.
Como funciona
The articles do not describe the specific code path. In general, a TOCTOU flaw means the software checks a condition, such as a permission or the state of a resource, and acts on it a moment later. If the state changes in that gap, the action runs on data that no longer matches what was checked. Which WordPress operation is involved is not stated.
Por que é vulnerável
The classification as a TOCTOU race condition points to a check and the use of its result that are not done atomically, so the state can change between them. The articles give no further root cause, no explanation of why it went unnoticed, and no description of what the fix changes.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. CISA added it to the KEV Catalog based on evidence of active exploitation, and it asks anyone aware of other exploited flaws to submit them through its KEV Nomination Form.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 19:16.
Remediação
Organizations running affected WordPress Core installations should apply available patches immediately, prioritize this vulnerability on publicly exposed assets, and check for signs of prior compromise before patching, consistent with BOD 26-04 requirements.
Linha do tempo
-
CISA Adds Actively Exploited WordPress Core TOCTOU Race Condition Flaw to KEV Catalog
ler a análise desta fonte ocultar
CISA has added CVE-2026-119977, a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize remediation of this vulnerability on internet-facing assets that could grant attackers total control post-exploitation, and verify whether systems were compromised prior to patching. While BOD 26-04 legally applies only to FCEB agencies, CISA urges all organizations to adopt risk-based vulnerability management and remediate this flaw promptly given its confirmed exploitation.
Remediation
Organizations running affected WordPress Core installations should apply available patches immediately, prioritize this vulnerability on publicly exposed assets, and check for signs of prior compromise before patching, consistent with BOD 26-04 requirements.