WordPress Core enters KEV: patching and verification priorities

CISA has added WordPress Core vulnerability CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalog. According to The Hacker News, the flaw has a CVSS score of 8.1 and can lead to arbitrary code execution on affected servers. Its inclusion in KEV brings evidence of exploitation in practice into patch prioritization decisions.

The remediation deadline of 6/11/2026 applies to US Federal Civilian Executive Branch agencies. It does not automatically impose an equivalent obligation on Vietnamese businesses, but the exploitation evidence is relevant when deciding which websites need attention first.

Why the upgrade process matters

The reported vulnerability involves a time-of-check/time-of-use (TOCTOU) race condition during upgrades of the complete WordPress Core package. Temporary staging locations used for the upgrade have predictable addresses and are accessible through the web.

According to the cited description, an unauthenticated attacker can execute code on the server during that window. Wordfence also says exploitation does not require a website account. Reviewing administrator accounts alone therefore cannot establish whether a site is protected against this flaw.

The source reports that patches are available.

TMGS recommendations

TMGS recommends prioritizing the fixes through a controlled update process that accounts for the risk during upgrades. For businesses using external website administrators, the IT lead should coordinate with both the internal website owner and the provider authorized to perform maintenance.

TMGS recommends these defensive actions:

• Inventory responsible WordPress sites, including outsourced sites, and compare their update status with official patch information.
• Assign a technical owner and agree on maintenance timing, backups, and recovery arrangements.
• Require completion evidence: the version after updating, the maintenance time, and website functionality checks.
• Review logs and unexpected changes around upgrades when anomalies appear; start incident response if suspicious signs are found.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/wordpress-core-vao-kev-uu-tien-va-den-dau-i.54eb0443-20d2-49e0-a4c8-b0644b455abf