CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

CISA has added CVE-2026-119977, a high-severity vulnerability in WordPress Core, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The flaw is a Time-of-check Time-of-use (TOCTOU) race condition with a CVSS score of 8.1. It can be exploited to achieve arbitrary code execution. The vulnerability is triggered during software upgrade processes. Organizations using WordPress are urged to apply patches promptly given the active exploitation confirmed by CISA.