US cybersecurity agency adds exploited WordPress Core flaw to catalog
CVE-2026-119977 is a time-of-check time-of-use race-condition flaw. CISA’s listing establishes evidence of active exploitation and brings it under federal risk-based remediation requirements.
In this article
CISA added a WordPress Core vulnerability to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, the agency said in its 3 November 2026 notice. The listing identifies a flaw already being exploited, rather than only a potential weakness.
The agency identifies it as a time-of-check time-of-use race condition: a timing flaw in which something can change between a software check and the action that relies on that check. CISA did not specify the affected version range, a patched version, a victim count or a specific remediation deadline.
What federal agencies must prioritize
The listing falls under Binding Operational Directive 26-04, which establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies. CISA says those agencies must prioritize rapid remediation of high-risk catalog-listed flaws on publicly exposed systems where exploitation grants total control, while deferring action on lower-risk vulnerabilities.
The directive also sets expectations for when agencies must check whether attackers compromised a system before it was patched. It applies only to those federal civilian agencies; CISA encourages other organizations to use risk-based vulnerability management and prioritize remediation of flaws in the catalog.
Earlier in Technology
SoftwareMicrosoft plans Google One backup for Authenticator on Android
Starting January 2027, Android users must enable Microsoft Authenticator in Google One backup instead of using a Microsoft personal account to enable backup, Microsoft says.
2 min
SoftwareGoogle to disable superintelligence (SI) on K–12 student accounts by default
Under the 2027 policy, administrators must opt in to enable the services. Schools that restrict superintelligence (SI) altogether will also lose student access to Google Search, the company says.
2 min
SuperintelligenceRelay redirects Codex and Claude Code requests, researchers say
Symantec and Carbon Black found the service in use at about 12 organizations. They found no evidence that it harvested prompts or altered responses, but its configuration removes an execution safeguard.
2 min
