WordPress Core Flaw Added to CISA's Known Exploited Vulnerabilities List

The US Cybersecurity and Infrastructure Security Agency (CISA) has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence that attackers are already exploiting it. The flaw is tracked as CVE-2026-119977 and affects WordPress Core. It is described as a time-of-check time-of-use (TOCTOU) race condition. CISA notes that this type of weakness is a frequent attack vector for malicious cyber actors.

The listing ties into CISA's Binding Operational Directive (BOD) 26-04, which requires US federal civilian agencies to fix high-risk vulnerabilities in the KEV Catalog quickly, particularly on publicly exposed systems where an attacker could gain total control. The directive also sets expectations for checking whether a system was compromised before a patch was applied.

The directive only binds federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise fixing KEV Catalog vulnerabilities. Many Australian small businesses run WordPress for their websites, so this listing is worth checking against your own systems.