On this page (7 sections)

CVE-2026-119977 is a time-of-check time-of-use (TOCTOU) race condition in WordPress Core. According to the NVD entry, it could allow unauthenticated attackers to execute code on the server during the upgrade window, because full-package core upgrades use predictable, web-accessible staging paths.

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-03. Anyone who runs a WordPress site, from business owners to agencies and hosting administrators, should check their core version and update.

What happened

The flaw was published on 2026-10-31 and the GitHub advisory was updated on 2026-11-03, the day CISA added it to KEV. The record describes remote code execution in WordPress Core versions 4.7 through 7.1.3. The issue sits in the core upgrade process itself rather than in a plugin or theme.

The sources do not name any attacker, campaign or number of compromised sites. CISA lists ransomware campaign use as Unknown. The GitHub advisory also gives an EPSS score of 0.6% (49th percentile), an estimate of exploitation probability over the next 30 days. That figure sits oddly next to the KEV listing, so treat the KEV status as the stronger signal.

How the weakness works

A TOCTOU race condition happens when software checks the state of a resource and then uses it, and the state can change between the check and the use in a way that invalidates the check. For this CVE, the sources say only this: predictable, web-accessible staging paths used during full-package core upgrades make it possible for unauthenticated attackers to execute code on the server during the upgrade window.

The CVSS vector describes a network attack needing no privileges and no user interaction, with attack complexity rated High and high impact on confidentiality, integrity and availability. The sources do not explain why complexity is rated High, so we do not speculate about it.

We are deliberately not describing exploitation details. The research does not provide them, and they are not needed to defend a site. The vendor code references are in the Trac source for 7.1.3 update-core.php and 7.1.4 update-core.php.

Who is affected

  • Any site on WordPress Core 4.7 through 7.1.3, which is a very wide range of installs.
  • Sites that perform full-package core upgrades, since the sources tie the exposure to the upgrade window of those upgrades.
  • Hosting administrators and agencies who manage WordPress installs for others should check the core version of each one. The sources do not describe any specific exposure for them beyond the version range.
The research does not say whether other kinds of upgrades are exposed. It names full-package core upgrades specifically, so do not assume a site is safe because of how or how often it updates. Checking the version is the reliable first step.

How to check your exposure

First find the installed core version. In the dashboard, open Dashboard then Updates, or run this read-only WP-CLI command from the site root. A result of 7.1.3 or lower (and 4.7 or higher) is in the affected range.

Show the installed WordPress Core version (run in the site root)WP-CLI
wp core version

Then ask WordPress whether a newer core release is offered. This lists available updates without applying them.

List available core updates without installing anythingWP-CLI
wp core check-update

What to do now

The vendor announced WordPress 7.1.4 in its release post, and the 7.1.4 code changes touch the same upgrader files that the advisory points to. The advisory data does not state a fixed version outright, so read the release post to confirm it addresses this issue for your branch, then update.

Caution. Take a full backup of files and the database before updating, and plan the update for a quiet period. Confirm afterwards that the update completed and the site loads normally.

Apply the update from the dashboard, or with WP-CLI as below. This replaces core files and may briefly put the site into maintenance mode.

Update WordPress Core to the latest release (run in the site root after a backup)WP-CLI
wp core update

CISA's KEV entry requires applying mitigations in line with vendor instructions and gives a due date of 2026-11-06. That deadline comes from CISA's catalog and does not bind most site owners, but it signals urgency.

Detection and monitoring afterwards

Because the flaw is on CISA's KEV list, it is prudent to verify site integrity after updating rather than trust the update alone. Compare core files against the official checksums, review the users list, and look for unexpected PHP files in uploads and other writable directories. The sources describe no specific indicators of compromise, so these are general hygiene checks.

Verify core files against official checksums (read-only, run in the site root)WP-CLI
wp core verify-checksums
List administrator accounts to spot unexpected users (read-only)WP-CLI
wp user list --role=administrator

A free malware scanner can give an outside-in look at your pages, though it cannot see everything on the server; see what outside-in detection can and cannot see. For ongoing change alerts, Webforta Monitor tracks uptime, certificate, DNS and header changes. If you suspect a compromise, follow website hacked: what to do.

Timeline

Key dates from the research
DateEvent
2026-10-31CVE-2026-119977 published by NVD and the GitHub Advisory Database
2026-11-03Added to CISA KEV; GitHub advisory updated
2026-11-06CISA KEV due date for required action

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. CVE-2026-119977 - GitHub Advisory Databasegithub.com
  2. WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2026-119977) is being actively exploitednvd.nist.gov ·
  • WordPress
  • CVE-2026-119977
  • CISA KEV
  • RCE
  • Core update