CVE-2026-119977HIGH
WordPress Core race condition in the upgrade window
A time-of-check time-of-use race condition in the WordPress Core updater lets an unauthenticated attacker execute code while a full core upgrade is running.
Updated 2026-11-11
Vendor hub
WordPress vulnerabilities
WordPress Core and the update infrastructure around it.
Dossiers
Recent CISA KEV entries
| CVE | Product | Added to KEV | Status | Dossier |
|---|---|---|---|---|
| CVE-2026-119977 | WordPress Core | 2026-11-03 | Active exploitation | Read → |
| CVE-2026-87902 | WordPress Core | 2026-09-25 | Active exploitation | Planned |
| CVE-2026-63030 | WordPress Core | 2026-07-21 | Active exploitation | Planned |
| CVE-2026-60137 | WordPress Core | 2026-07-21 | Active exploitation | Planned |
| CVE-2019-9978 | WordPress Social Warfare Plugin | 2021-11-03 | Active exploitation | Planned |
| CVE-2020-11738 | WordPress Snap Creek Duplicator Plugin | 2021-11-03 | Active exploitation | Planned |
| CVE-2020-25213 | WordPress File Manager Plugin | 2021-11-03 | Active exploitation | Planned |