CISA KEV: WordPress Core TOCTOU race condition CVE-2026-119977
Original title: CISA KEV: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability — WordPress WordPress Core (CVE-2026-119977)
WordPress Core upgrade TOCTOU vulnerability enables unauthenticated code execution during staging.
WordPress WordPress Core contains a time-of-check time-of-use race condition that allows unauthenticated attackers to execute code on the server during the upgrade window. Predictable web-accessible staging paths are used in full-package core upgrades. CISA added it to KEV catalog; required action is to apply mitigations per vendor instructions and BOD 26-04.
- TOCTOU race condition in core upgrades
- Predictable staging paths allow code execution
- Unauthenticated remote execution possible
- Due date: 2026-11-06
- 1.Apply mitigations in accordance with vendor instructions
- 2.Ensure compliance with CISA BOD 26-04
- 3.Follow forensics triage requirements
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-119977 | Unauthenticated RCE in WordPress Core during upgrades | 8.1 | <1% | KEVPoC | KEV |
From the original article
1 min read at cisa.govWordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.