CISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog
CISA has added CVE-2026-119977, a WordPress Core Time-of-check Time-of-use (TOCTOU) race condition vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-119977 to its catalog of Known Exploited Vulnerabilities (KEV). This designation signifies that the vulnerability, a Time-of-check Time-of-use (TOCTOU) race condition within WordPress Core, has been observed under active exploitation in the wild.
TOCTOU vulnerabilities, often referred to as race conditions, occur when a program checks the state of a resource at one point in time and then acts upon that state at a later point. If the state of the resource changes between the check and the action, it can lead to unexpected and potentially exploitable behavior. In the context of WordPress Core, such a flaw could allow attackers to bypass security checks or gain unauthorized privileges by manipulating the timing of operations.
The inclusion of CVE-2026-119977 in the KEV catalog carries significant implications, particularly for Federal Civilian Executive Branch (FCEB) agencies. Binding Operational Directive (BOD) 26-04 mandates that these agencies prioritize the remediation of vulnerabilities listed in the KEV catalog, especially those on publicly exposed assets that could lead to full system control post-exploitation.
This directive underscores the critical nature of the WordPress Core vulnerability. By being flagged as actively exploited, it presents a clear and present danger to organizations running vulnerable versions of the popular content management system. The potential for attackers to leverage this flaw for unauthorized access or control necessitates swift action from system administrators.
While BOD 26-04 specifically targets FCEB agencies, CISA strongly encourages all organizations, regardless of sector, to adopt a risk-based vulnerability management approach. Prioritizing the patching and mitigation of vulnerabilities listed in the KEV catalog, such as CVE-2026-119977, is a crucial step in bolstering overall cybersecurity defenses.
CISA continues to monitor the threat landscape and will regularly update the KEV catalog with new vulnerabilities that meet the established criteria for active exploitation. The agency also provides a nomination form for the public to submit evidence of exploited vulnerabilities not yet listed, emphasizing the collaborative effort required to maintain a secure digital environment.
The addition of this WordPress Core vulnerability highlights the ongoing challenges in securing widely used software. Attackers consistently target popular platforms like WordPress, seeking to exploit even subtle flaws to gain a foothold in networks. Organizations must remain vigilant and proactive in their security practices to defend against such threats.