CISA has added a high-severity vulnerability in WordPress Core, tracked as CVE-2026-119977 (CVSS score: 8.1), to its Known Exploited Vulnerabilities catalog, citing active exploitation. This Time-of-check Time-of-use (TOCTOU) race condition can allow unauthenticated attackers to execute arbitrary code during the upgrade window. Patches were released late last month. Wordfence noted that no account is needed to exploit the flaw, just a brief window during a core update. Over 18,500 targeted requests were recorded within 21 hours of disclosure, with 12,632 blocked in 24 hours. CISA mandates Federal Civilian Executive Branch agencies to apply fixes by November 6, 2026, following confirmed exploitation.
