WordPress Vulnerability Joins CISA KEV With a Nov 6 Federal Patch Deadline

CISA added a WordPress Core remote code execution to its Known Exploited Vulnerabilities catalog on Nov 3, 2026, and gave federal civilian agencies until Nov 6 to apply the vendor's fix under the binding operational directive BOD 26-04. The entry, CVE-2026-119977, is a time-of-check time-of-use race in WordPress's own full-package upgrade routine that lets an unauthenticated attacker run code on the server during the upgrade window, and its described reach is unusually wide: WordPress core versions 4.7 through 7.1.3, a span that runs from the December 2016 release to just before last week's security update.

The contrast with the catalog's other fresh addition makes the difference in transmiss…