WordPress Core enters KEV: patching and verification priorities

The WordPress Core software has been added to the Known Exploited Vulnerabilities (KEV) catalog by the Cybersecurity and Infrastructure Security Agency (CISA). This vulnerability, CVE-2026-119977, has a high severity CVSS score of 8.1 and allows for arbitrary code execution on affected servers. The inclusion in the KEV catalog signals that the vulnerability has already been exploited in the wild, influencing patching priorities for various organizations.

The vulnerability stems from a time-of-check/time-of-use (TOCTOU) race condition during the upgrade process of the complete WordPress Core package. During this upgrade, temporary staging locations are used, which can be predictably accessed and targeted by attackers. Unauthenticated attackers are capable of exploiting this flaw without needing a website account.

The remediation deadline for this vulnerability is set for 6/11/2026, primarily for US Federal Civilian Executive Branch agencies, but the evidence of exploitation is still relevant for other entities and businesses worldwide.

Wordfence, a security company, confirms that exploitation is possible without any credentials, emphasizing the need for urgent action. To address this issue, TMGS (The Massachusetts Governor's Statewide IT) recommends businesses review their WordPress sites, including those maintained by external administrators. A comprehensive inventory of all affected sites should be conducted, and a technical owner needs to be assigned to manage updates, maintenance scheduling, backups, and recovery procedures.

Additionally, businesses must ensure that proper evidence, such as post-update version verification, maintenance time documentation, and website functionality checks, are completed to confirm the successful remediation of the vulnerability.

Guidelines also suggest reviewing logs and any unexpected changes during upgrades for potential signs of suspicious activity. If any anomalies are detected, an incident response should be initiated promptly. For more details on the recommendations, refer to TMGS's full analysis located at https://tmgs.vn/tin-tuc/wordpress-core-vao-kev-uu-tien-va-den-dau-i.