Correction: a content-management flaw was disclosed a day earlier than recorded, so its pre-disclosure candidacy is withdrawn
Every record in this file was ratified by the publisher on 2026-11-12 and is in force. The declared field gives the date the correction was first recorded.
- id
- CHQ-CORR-2026-030
- class
- CORRECTION
- subtype
- counting
- status
- IN FORCE
- authority
- DM ratified 2026-11-12
- effective
- 2026-11-12
- published
- 2026-11-12
- title
- Correction: a content-management flaw was disclosed a day earlier than recorded, so its pre-disclosure candidacy is withdrawn
- what was wrong
- The record gave 29 October 2026 as the first public disclosure of WordPress Core CVE-2026-119977, taken from a secondary advisory date, and carried the entry as a candidate for Pre-Disclosure Exploitation because an exploitation attempt was observed on 28 October.
- what is true
- The vendor's own announcement is timestamped 28 October at 17:13 UTC. The first observed attempt followed at about 20:39 UTC the same day. With a timestamp on both events the chronology is determinate and post-disclosure.
- what changed
- The disclosure date is corrected to 28 October and the candidate status is withdrawn; the entry is recorded as not in shape for the condition. The previous values are kept in the row note. The attempt telemetry is kept as evidence of attempts, not of compromise.
- what did not change
- No count, rating, Outlook or Watch. The entry's routing as a reinforcing entry on the edge condition stands.
- control analysis
- A secondary date stood in for the primary. The audit that found it asked for the chronology to be marked indeterminate; reading the primaries showed it was determinate, which is the stronger correction. Reading the vendor primary for the disclosure date is a protocol rule, not a mechanical control.
- found by
- An external adversarial audit, verified by CHQ against the primaries.