CVE-2026-119977: WordPress Core Time-of-Check Time-of-Use Race Condition Vulnerability

# CVE-2026-119977: WordPress Core Time-of-Check Time-of-Use Race Condition Vulnerability

https://gcdradar.vercel.app/incidents/cve-2026-119977-wordpress-core-time-of-check-time-of-use-rac · AIR-2026-1753 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Exploited in the wild as confirmed by CISA KEV.
- Fix status: Patched
- First reported: 2026-11-03
- AI role: No AI role
- Products: WordPress Core
- CVE ids: CVE-2026-119977
- CVSS: 8.1

## Summary

WordPress core contains a time-of-check time-of-use race condition vulnerability allowing unauthenticated attackers to execute code via predictable staging paths during upgrades. CISA added the flaw to its known exploited vulnerabilities catalog following confirmed in-the-wild exploitation.

## What to do

Block web access to the staging directory while applying WordPress updates to prevent race condition exploitation during the installation phase.

## Affected and fixed versions

- Affected: WordPress Core

## Latest updates

- 2026-11-06: Research shows the WordPress update process can be vulnerable during installation, requiring web access to the staging path to be blocked. (https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html)
- 2026-11-03: CVE-2026-119977: WordPress WordPress Core — WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977)

## Sources

- 2026-11-03 CISA: CVE-2026-119977: WordPress WordPress Core — WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
- 2026-11-04 The Hacker News: CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html
- 2026-11-04 BleepingComputer: CISA flags WordPress RCE flaw as actively exploited in attacks https://bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks
- 2026-11-06 The Hacker News: Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.