CISA added a vulnerability identified as CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on 2026-11-03. The flaw resides in WordPress WordPress Core and is described as a Time-of-check Time-of-use (TOCTOU) race condition. During a full-package core upgrade, predictable, web-accessible staging paths can be exploited, allowing unauthenticated attackers to execute code on the server within the upgrade window. The entry notes that the vulnerability is actively exploited. CISA’s guidance calls for applying mitigations according to vendor instructions and ensuring compliance with CISA’s BO. 1