WordPress CVE-2026-119977 Zero-Day Added to CISA KEV Under Active Exploitation
Key findings • CVE-2026-119977, a WordPress vulnerability, is actively exploited in the wild. • CISA added this flaw to its Known Exploited Vulnerabilities Catalog on November 3, 2026. • …
Key findings
- CVE-2026-119977, a WordPress vulnerability, is actively exploited in the wild.
- CISA added this flaw to its Known Exploited Vulnerabilities Catalog on November 3, 2026.
- Immediate patching of all WordPress installations is critical to prevent compromise.
- Active exploitation means attackers are already leveraging this vulnerability.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a newly identified vulnerability in WordPress, CVE-2026-119977, which has been added to its Known Exploited Vulnerabilities (KEV) Catalog. This addition on November 3, 2026, signals that the flaw is under active exploitation by malicious actors, posing an immediate threat to unpatched WordPress installations globally. The inclusion in the KEV catalog underscores the urgency for organizations and individuals to address this security risk promptly.
CVE-2026-119977 represents a significant security concern within the WordPress ecosystem. While specific details of the exploit are often withheld to prevent further malicious activity, its presence in the KEV catalog indicates that attackers have successfully developed and deployed exploits targeting this flaw. Such vulnerabilities can lead to various detrimental outcomes, including unauthorized access, data breaches, website defacement, or the injection of malware, compromising the integrity and availability of affected sites.
Given the confirmed active exploitation, immediate action is paramount for all WordPress users and administrators. CISA mandates federal civilian executive branch agencies to remediate KEV vulnerabilities by specific deadlines, and this guidance serves as a critical recommendation for all organizations. Defenders should prioritize patching all WordPress installations to the latest secure version as soon as updates addressing CVE-2026-119977 become available. Regularly backing up website data and implementing robust security practices, such as strong authentication and monitoring for suspicious activity, are also crucial steps to mitigate potential risks.