WordPress wordpress Time-of-check Time-of-use (TOCTOU) Race Condition

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• vendor WordPress Foundationversion unspecified
• vendor WordPress WordPress Coreversion unspecified
• vendor WordPress wordpressversion unspecified

How to fix CVE-2026-119977

• Vendor action

  Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

• Version check

  No version range is stored, so an installed version cannot be checked on this page.

• Advisory

  Open the canada record and follow its fix. CISA lists a due date of Nov 6, 2026.

• Official advisories

  • Canadian Centre for Cyber Security · cyber.gc.ca
  • CISA Cybersecurity Advisories · cisa.gov
  • CISA KEV · cisa.gov
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • EUVD · euvd.enisa.europa.eu

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Technology hubs

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Related records

Linked stories and findings that share CVE identifiers or explicit correlation edges.

• Threat intelligence · discusses

  Active Exploitation of WordPress Core Vulnerability Confirmed by CISA

• Threat intelligence · discusses

  Critical WordPress Vulnerability Exploited by Hackers

Timeline

Detection, updates, and resolution for this record.

1. Oct 30, 2026 · VulnCheck KEV

   Detected

   CVE-2026-119977 is listed in VulnCheck KEV.

2. Oct 30, 2026 · CISA KEV

   Known exploited

   Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

3. Oct 31, 2026 · EUVD

   Updated

   WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

4. Nov 3, 2026 · CISA KEV

   Updated

   WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.

5. Nov 3, 2026 · EUVD

   Updated

   WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

6. Nov 4, 2026 · EUVD

   Updated

   WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

7. Nov 6, 2026 · CISA KEV

   Remediation due

   Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating

Sources

• Canadian Centre for Cyber SecurityGovernment advisoryCVE-2026-119977

  Serial number: AV26-1117 Date: November 3, 2026 As of October 31, 2026, WordPress is affected by a vulnerability in the following product: WordPress Core Prior to 7.1.4 On November 3, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to their Kno

  cyber.gc.ca
• CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2026-119977

  CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability This type of vulnerability is a frequent attack vec

  cisa.gov
• CISA KEVConfirmed exploitationCVE-2026-119977

  WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.

  cisa.gov
• CVE.orgVulnerability recordCVE-2026-119977

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-119977

  30-day exploitation probability 1.16%

  first.org
• EUVDVulnerability recordEUVD-2026-114575

  WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgr

  euvd.enisa.europa.eu
• NCSC NetherlandsGovernment advisoryCVE-2026-119977

  WordPress heeft een kwetsbaarheid verholpen in WordPress Core versies 4.7 tot en met 7.1.3. De kwetsbaarheid maakt misbruik mogelijk van een TOCTOU-racecondition (Time-of-Check to Time-of-Use) tijdens volledige WordPress Core-upgrades. Hierdoor kan een niet-geauthenticeerde aanva

  advisories.ncsc.nl
• OpenCVEVendor advisoryCVE-2026-119977

  CVE-2026-119977 is named on the public OpenCVE page.

  opencve.io
• Red Hat Security DataVendor advisoryCVE-2026-119977

  wordpress: WordPress: Arbitrary code execution via predictable upgrade staging paths

  access.redhat.com
• Tenable CVE DatabaseVulnerability recordCVE-2026-119977

  WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

  tenable.com
• VulnCheck KEVConfirmed exploitationCVE-2026-119977

  WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-packag

  vulncheck.com

References

• EUVD reference · core.trac.wordpress.org
• EUVD reference · core.trac.wordpress.org
• EUVD reference · core.trac.wordpress.org
• EUVD reference · core.trac.wordpress.org
• EUVD reference · core.trac.wordpress.org
• EUVD reference · core.trac.wordpress.org
• EUVD record · euvd.enisa.europa.eu
• CISA note · nvd.nist.gov
• CISA note · wordpress.org
• EUVD reference · wordpress.org
• CISA note · cisa.gov
• CISA note · cisa.gov
• VulnCheck exploitation evidence · cisa.gov
• EUVD reference · wordfence.com
• CISA note · wordfence.com
• VulnCheck exploitation evidence · wordfence.com

Freshness

Last verified in this catalog Nov 8, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

• FIRST EPSSNov 8, 2026
• EUVDNov 8, 2026
• CISA Cybersecurity AdvisoriesNov 7, 2026
• Canadian Centre for Cyber SecurityNov 7, 2026
• CISA KEVNov 6, 2026
• NCSC NetherlandsNov 6, 2026
• VulnCheck KEVNov 4, 2026
• Red Hat Security DataNov 3, 2026
• Tenable CVE DatabaseNov 1, 2026
• CVE.orgOct 31, 2026
• OpenCVEOct 31, 2026