importantSYS.SOURCE: The Hacker News• 2026-11-04T11:13:11+05:30

CISA Adds WordPress Core TOCTOU Vulnerability to KEV Catalog

#wordpress #cisa #vulnerability #exploitation #security

CISA has added the high-severity TOCTOU race condition vulnerability in WordPress Core (CVE-2026-119977) to the KEV catalog, citing active exploitation. The flaw, with a CVSS score of 8.1, could allow attackers to execute arbitrary code through timing discrepancies during software upgrades.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code

Read original article

*** END OF TRANSMISSION ***

> DEBIAN APT SECURITY UPDATE: MAN-IN-THE-MIDDLE ARBITRARY CODE EXECUTION > INTERACTIVE MAP OF 5000+ 2026 MIDTERM ELECTION ADVERTISEMENTS > CYBERATTACK ON FRENCH NATIONAL BLOOD BANK DISRUPTS OPERATIONS > CRITICAL RUBY ON RAILS VULNERABILITY ENABLES ARBITRARY FILE WRITING THROUGH IMAGEMAGICK UPLOADS > CANVA ANNOUNCES 22% STAFF REDUCTION AMID GROWTH SLOWDOWN AND STRATEGIC RESTRUCTURING > PHP2SHELL VULNERABILITY EXPOSES 40 YEARS OF TECHNICAL DEBT IN CYBERSECURITY > XEN HYPERVISOR VULNERABILITIES ENABLE CROSS-VM MEMORY ACCESS ATTACKS > AGENT RUNTIME SECURITY LIMITATIONS IN UNMONITORED TRAFFIC ENVIRONMENTS > CHINA-ALIGNED THREAT ACTOR EXPLOITS SOGOU INPUT METHOD VULNERABILITY FOR DARKVIGIL DEPLOYMENT > SYNAPTICS APPEARS TO USE LEGAL THREATS TO BLOCK OPEN-SOURCE DISPLAYLINK DRIVER> DEBIAN APT SECURITY UPDATE: MAN-IN-THE-MIDDLE ARBITRARY CODE EXECUTION > INTERACTIVE MAP OF 5000+ 2026 MIDTERM ELECTION ADVERTISEMENTS > CYBERATTACK ON FRENCH NATIONAL BLOOD BANK DISRUPTS OPERATIONS > CRITICAL RUBY ON RAILS VULNERABILITY ENABLES ARBITRARY FILE WRITING THROUGH IMAGEMAGICK UPLOADS > CANVA ANNOUNCES 22% STAFF REDUCTION AMID GROWTH SLOWDOWN AND STRATEGIC RESTRUCTURING > PHP2SHELL VULNERABILITY EXPOSES 40 YEARS OF TECHNICAL DEBT IN CYBERSECURITY > XEN HYPERVISOR VULNERABILITIES ENABLE CROSS-VM MEMORY ACCESS ATTACKS > AGENT RUNTIME SECURITY LIMITATIONS IN UNMONITORED TRAFFIC ENVIRONMENTS > CHINA-ALIGNED THREAT ACTOR EXPLOITS SOGOU INPUT METHOD VULNERABILITY FOR DARKVIGIL DEPLOYMENT > SYNAPTICS APPEARS TO USE LEGAL THREATS TO BLOCK OPEN-SOURCE DISPLAYLINK DRIVER