Skip to main content
Apexward Pulse

WordPress

WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

CVE-2026-119977

What this means

This is rated high severity (8.1 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Wordpress Wordpress is in your estate, and treat that as the priority.

Full vendor description

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Scoring and exploitation

8.1/ 10
CVSS 3.1 base scoreHigh

Exploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityHighAC:H
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
~1.2% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
WordPress Core

Weaknesses

CWE-367

Affected products ()

  • Wordpress Wordpress
Show the raw CPE strings (1)
  • cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

References

10 links from the CVE record, grouped by site.

Related feed events

  • WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

    Type Vulnerability

    CISA has added one new vulnerability to its known-exploited catalogue, based on evidence of active exploitation.

    Next step: Confirm whether WordPress Core is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 2Vendor statement missing. no VendorResearcher coverage missing. no Researcher2 signals

    Only official coverage so far. Treat as an early signal.

    WordPress CoreWordPress Core
    CVE-2026-119977