CVE-2026-119977 — WordPress Core time-of-check to time-of-use (TOCTOU) race condition vulnerability

The CISA Known Exploited Vulnerabilities Catalog contains an entry for CVE-2026-119977, concerning a TOCTOU race condition vulnerability in WordPress Core. CISA describes the KEV Catalog as an authoritative source of vulnerabilities exploited in the wild and recommends that organizations use it as an input to vulnerability-management prioritization.