CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

KEV

Undergoing analysis

Published 31-10-2026Last modified 03-11-2026

Vulnerability summary

CVE-2026-119977 is a high (CVSS 8.1) vulnerability in WordPress WordPress Core. It is known to be exploited: CISA lists it, first on 03-11-2026. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.1/10

010

High · v3.1 (CVE.org)

EPSS score

0.60%

0%100%

Low · Change unavailable

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

31-10-2026
PublishedVulnerability first disclosed.
03-11-2026
Added to CISA KEVExploitedWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
03-11-2026
Last modifiedVulnerability information updated.
06-11-2026
CISA remediation dueUpcomingApply mitigations per vendor instructions.

Description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

CVSS metrics

2 scores · 2 sources · 1 version

v3.18.1

EPSS trend

Probability

0.60%

Chance of exploitation in the next 30 days

Percentile

49%

Versus all other CVEs

30-day change

Change unavailable

31-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 03-11-2026
Federal due date: 06-11-2026

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. wordpress.org/news/2026/10/wordpress-7-1-4 www.wordfence.com/threat-intel/… nvd.nist.gov/vuln/detail/CVE-2026-119977

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Wordpress foundation1 product

wordpress≥ 4.7.0, ≤ 4.7.38 | ≥ 4.8.0, ≤ 4.8.33 | ≥ 4.9.0, ≤ 4.9.34 | ≥ 5.0.0, ≤ 5.0.30 | ≥ 5.1.0, ≤ 5.1.27 | ≥ 5.2.0, ≤ 5.2.29 | ≥ 5.3.0, ≤ 5.3.26 | ≥ 5.4.0, ≤ 5.4.24 | ≥ 5.5.0, ≤ 5.5.23 | ≥ 5.6.0, ≤ 5.6.22 | ≥ 5.7.0, ≤ 5.7.20 | ≥ 5.8.0, ≤ 5.8.18 | ≥ 5.9.0, ≤ 5.9.19 | ≥ 6.0.0, ≤ 6.0.17 | ≥ 6.1.0, ≤ 6.1.15 | ≥ 6.2.0, ≤ 6.2.14 | ≥ 6.3.0, ≤ 6.3.13 | ≥ 6.4.0, ≤ 6.4.13 | ≥ 6.5.0, ≤ 6.5.13 | ≥ 6.6.0, ≤ 6.6.10 | ≥ 6.7.0, ≤ 6.7.10 | ≥ 6.8.0, ≤ 6.8.11 | ≥ 6.9.0, ≤ 6.9.10 | ≥ 7.0.0, ≤ 7.0.7 | ≥ 7.1.0, ≤ 7.1.3

1 vendor · 1 product

References

10 links