The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
This vulnerability is being actively exploited in the wild, according to the CISA Known Exploited Vulnerabilities catalog. CISA added it on .
CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
- Identifier
- CVE-2026-119977
- Published
- Record updated
- Fixed in
- The source references a patch, a mitigation or a vendor advisory.
- Known exploitation
- Listed in the CISA Known Exploited Vulnerabilities catalog since November 3, 2026.
- EPSS
- 1.0%
Summary
CVE-2026-119977 is a time-of-check time-of-use (TOCTOU) race condition in WordPress Core. The flaw lies in predictable, web-accessible staging paths used during full-package core upgrades. Unauthenticated attackers could exploit it to execute code on the server during the upgrade window.
Mitigation
Apply mitigations in accordance with vendor instructions, referencing the WordPress 7.1.4 release at https://wordpress.org/news/2026/10/wordpress-7-1-4. Ensure compliance with CISA BOD 26-04 guidance, and follow the BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure. Due date: 2026-11-06.