poslední zpráva
SPOJENO AI KEV ✓ EPSS 0.01
CISA flags WordPress RCE flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. [...]
WordPress US NL CA
CVE v události 1
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-119977 | 8.1 3.1 · Wordfence | KEV ✓ | 0.01 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.
Tahle CVE jsem vytáhl z širšího textu článku: CVE-2026-60137, CVE-2026-63030. Neukazuju u nich proto fakta z katalogů výše, a to preventivně, protože článek se na ně mohl jen odkazovat, třeba jako na starší kauzu.
Jak se o tom psalo 4
-
· BleepingComputer US nadpis události
CISA flags WordPress RCE flaw as actively exploited in attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. [...]
-
· NCSC-NL NL
NCSC-2026-0466 [1.00] [L/H] Kwetsbaarheid verholpen in WordPress Core
WordPress heeft een kwetsbaarheid verholpen in WordPress Core versies 4.7 tot en met 7.1.3. De kwetsbaarheid maakt misbruik mogelijk van een TOCTOU-racecondition (Time-of-Check to Time-of-Use) tijdens volledige WordPress Core-upgrades. Hierdoor kan een niet-geauthenticeerde aanvaller op afstand code uitvoeren op de server door het korte upgradevenster te misbruiken waarin de stagingdirectories via het web toegankelijk zijn. Voor succesvolle exploitatie moet de aanvaller erin slagen om tijdens…
-
· Cyber Centre Kanada CA
WordPress security advisory (AV26-1117)
Serial number: AV26-1117 Date: November 3, 2026 As of October 31, 2026, WordPress is affected by a vulnerability in the following product: WordPress Core Prior to 7.1.4 On November 3, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. WordPress 7.1.4 WordPress…
-
· zachyceno · CISA KEV US
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2026-119977)
CISA added CVE-2026-119977 to the Known Exploited Vulnerabilities catalog. Affected product: WordPress WordPress Core. Remediation due date: 2026-11-06.