CISA Adds Actively Exploited WordPress Core Flaw to KEV — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- CISA added the WordPress Core security flaw to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
- CVE-2026-119977 is the tracking identifier for the high-severity flaw, which carries a CVSS score of 8.1 and was exploited during software upgrades.
Why it matters: For WordPress Core site operators, the CVSS 8.1 score and confirmed active exploitation make CVE-2026-119977 a concrete remediation target rather than a theoretical defect. CISA's KEV placement formally identifies the upgrade-period flaw as one the agency tracks because attackers are already exploiting it.
Ask SkimNews
