WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

🚨SEVERITY: HIGH — CVSS 8.1Security Advisory

TL;DR 📌

  • WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
  • Highest CVSS: 8.1 (High).
  • Listed in CISA KEV (2026-11-03) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-119977.

What it is

CVE-2026-119977 is a time-of-check time-of-use (TOCTOU) race condition in WordPress Core. It affects versions 4.7 through 7.1.3.

The flaw sits in the full-package core upgrade process. When WordPress performs this type of upgrade, it writes new core files to a staging path before swapping them into place. That staging path is predictable and web-accessible while the upgrade is in progress. An attacker who can reach the site over HTTP, without any authentication, can request files from that path during the narrow window between the check and the use of those files, and get code executed on the server.

The attack requires no credentials and no user interaction (AV:N, PR:N, UI:N in the CVSS vector), but it does require the attacker to win a timing race against an in-progress upgrade (AC:H). Because the vector is network-based and hits the data plane rather than an admin interface, exposure is tied to when an upgrade is running, not to whether an attacker has an account.

CVSS 3.1 scores this 8.1 (High): confidentiality, integrity and availability impacts are all rated High, consistent with arbitrary code execution on the web server. It is listed in the CISA Known Exploited Vulnerabilities catalogue, added 3 November 2026, meaning it is known to be exploited.

What to do

  • Check installed WordPress Core version against the affected range (4.7 through 7.1.3). The advisory should be consulted for a fixed release, as none is listed yet in the data reviewed here.
  • Because this is a KEV-listed, actively exploited flaw, treat it as urgent regardless of patch availability: review change logs and update as soon as a fixed version is published.
  • During any core upgrade, minimise the window of exposure: avoid triggering upgrades on internet-facing sites during peak traffic, and consider restricting access to the site (e.g. maintenance mode or IP allow-listing) while the upgrade completes.
  • Audit web server access logs for requests to staging-related paths coinciding with upgrade events, as a way of checking for exploitation attempts.
  • Given the unauthenticated, remote nature of the flaw, prioritise sites that perform automated or unattended core upgrades, since there is no human in the loop to limit the exposure window.

For leadership 🧭

Executive summary. Any WordPress site running a version between 4.7 and 7.1.3 is exposed to remote code execution during the brief window an automatic or manual core upgrade is applying, with no attacker credentials required. This is already listed as actively exploited, so sites that run unattended upgrades should be reviewed today rather than at the next scheduled patch cycle.

Why it matters:

  • The vulnerability lives in WordPress Core’s full-package upgrade routine, which writes new files to a predictable, web-reachable staging path before swapping them in – an unauthenticated visitor can request that path during the swap.
  • CVSS 8.1 with High confidentiality, integrity and availability impact reflects arbitrary code execution on the web server itself, not just the admin dashboard.
  • It is in the CISA KEV catalogue (added 3 November 2026), meaning it is known to be exploited in the wild right now.
  • Sites configured for automated or unattended core updates are most exposed, since there is no person watching the upgrade window to spot or stop an attack.

Now / Next / Later:

  • Now: Identify every WordPress install on the estate still running a version between 4.7 and 7.1.3, and check whether automatic background updates are enabled on any of them.
  • Next: During the next scheduled core upgrade, restrict site access (maintenance mode or IP allow-listing) for the duration of the upgrade, and watch for a vendor-published fixed release to apply immediately once available.
  • Later: Build a standing process that pauses public access or front-ends upgrades through a controlled path for any core update, so the staging window is never reachable by anonymous traffic.

Source