CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Summary
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability in WordPress Core (CVE-2026-119977) could allow unauthenticated attackers to execute code on the server during the upgrade process. This is caused by predictable, web-accessible staging paths used for core upgrades.
IFF Assessment
This vulnerability allows unauthenticated attackers to execute code on the server, posing a significant risk to website security.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: November 06, 2026. Known ransomware use: Unknown.
Defender Context
Defenders need to be aware of this critical vulnerability in WordPress Core which allows for remote code execution. Prioritizing updates and applying vendor-recommended mitigations is crucial, especially for internet-facing assets, to prevent exploitation during the upgrade window.