CISA Adds WordPress RCE CVE-2026-119977 to KEV Catalog: What Security Teams Must Do Now
In late October 2026, the WordPress security team patched a high-severity remote code execution vulnerability (CVE-2026-119977) rooted in a Time-of-Check Time-of-Use race condition within WordPress Core's upgrade process. Attackers can exploit predictable, web-accessible staging paths during full-package core upgrades to execute arbitrary code on unpatched servers without requiring authentication privileges. CISA confirmed active exploitation on November 3, 2026, adding the flaw to its Known Exploited Vulnerabilities catalog and ordering FCEB agencies to patch by November 7. WordPress security firm Wordfence reported blocking over 13,000 attacks targeting this vulnerability within a single 24-hour window, underscoring rapid and widespread threat actor adoption. This incident follows a pattern of accelerating WordPress Core exploitation in 2026, including the wp2shell chain (CVE-2026-63030, CVE-2026-60137) weaponized by Chinese-speaking threat actors to exfiltrate data from over 18,500 records across government and small business databases. The convergence of unauthenticated RCE, short patch-to-exploit timelines, and nation-state interest in WordPress infrastructure signals a sustained and escalating threat to web-facing organizations.
Kill Chain
