{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:28.337Z","products":["wordpress"],"actNowTotal":2,"results":[{"query":"wordpress","matched":2,"actNow":2,"events":[{"id":"kev-2026-09-25-wordpress-core","url":"https://securitythreatpulse.com/events/kev-2026-09-25-wordpress-core","title":"WordPress Core: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 49 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The exploit prediction score is 96%.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-87902"],"vendor":"WordPress","product":"Core","affectedProducts":[{"kind":"direct","slug":"wordpress/core","vendor":"WordPress","product":"Core","evidence":["kev"],"vendorKey":"wordpress","productKey":"core"},{"kind":"direct","slug":"wordpress/wordpress","vendor":"WordPress","product":"WordPress","evidence":["cpe"],"vendorKey":"wordpress","productKey":"wordpress"}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","cvss":8.1,"epss":0.95769,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-25","kevDueDate":"2026-09-28","firstSeenAt":"2026-09-25T00:00:00.000Z","updatedAt":"2026-11-10T17:00:05.132Z","newestEvidenceAt":"2026-11-10T22:51:26.891Z"},{"id":"kev-2026-11-03-wordpress-wordpress-core","url":"https://securitythreatpulse.com/events/kev-2026-11-03-wordpress-wordpress-core","title":"WordPress Core: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 11 days old, so many systems are likely still unpatched.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","The confirmation is 8 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-119977"],"vendor":"WordPress","product":"WordPress Core","affectedProducts":[{"kind":"direct","slug":"wordpress/wordpresscore","vendor":"WordPress","product":"WordPress Core","evidence":["kev"],"vendorKey":"wordpress","productKey":"wordpresscore"},{"kind":"direct","slug":"wordpress/wordpress","vendor":"WordPress","product":"WordPress","evidence":["cpe"],"vendorKey":"wordpress","productKey":"wordpress"}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.","cvss":8.1,"epss":0.01199,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-11-03","kevDueDate":"2026-11-06","firstSeenAt":"2026-11-03T00:00:00.000Z","updatedAt":"2026-11-11T06:00:07.898Z","newestEvidenceAt":"2026-11-10T18:06:40.927Z"}]}]}