ZeroDayAlert

CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.

WordPress WordPress Core Added to KEV 2026-11-03 Federal due 2026-11-06 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition in its upgrade mechanism. The vulnerability allows unauthenticated attackers to execute code on the server during the window when WordPress is performing a full-package core upgrade, by exploiting predictable and web-accessible staging paths. The record does not specify which versions of WordPress Core are affected, nor does it name a patch version.

How to check whether this touches you

  • Inventory your WordPress installations and identify which are directly internet-facing versus behind a WAF, reverse proxy, or load balancer.
  • Check whether your WordPress instances perform unattended automatic core upgrades (via WP_AUTO_UPDATE_CORE or similar) and whether you monitor the upgrade process.
  • Run a request to your WordPress installation root and note the HTTP response headers and publicly visible version strings; this signals but does not prove your current version, as backports exist.
  • If you host WordPress on a shared or managed platform, confirm with your provider whether they handle core upgrades and what staging paths they use.

What to do

  1. If you cannot patch immediately, restrict web access to your WordPress installation directory (or the entire staging/upgrade paths) using firewall rules, WAF rules, or .htaccess restrictions to allow only your own administrative traffic during upgrades.
  2. Disable automatic core upgrades if they are enabled, and schedule manual upgrades during a controlled maintenance window when you can monitor the process.
  3. Enable query logging and access logging on your web server, and retain logs for at least 30 days to support later forensic review if needed.
  4. Apply the remediation steps issued by WordPress (consult their security advisories for your release cycle) and verify the upgrade completes without error before returning the instance to production.
  5. If you are unable to apply mitigations and cannot patch, escalate to your security governance team to evaluate whether discontinuation or replacement of WordPress is required per BOD 26-04 guidance.

If you find you were exposed

Exploitation of a race condition typically requires precise timing and may succeed silently; log retention is the primary constraint. Review web server access logs covering the period of any failed or interrupted upgrades for suspicious requests to staging paths or for POST requests during the upgrade window from unexpected source IPs. If you identify suspicious activity, preserve logs and engage forensic review to determine whether code execution occurred.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-119977 is being exploited. It cannot tell you whether WordPress Core is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →