Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since November 3, 2026.
CVE-2026-119977
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Added to KEV November 3, 2026
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2026-119977
- CWE
- CWE-367
- Affected products
- WordPress Core · WordPress WordPress Core · WordPress
What happened
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
What it means for your business
WordPress WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-119977). WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. CISA remediation due date: 2026-11-06. If you need help checking exposure, call (864) 335-9223.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: November 6, 2026
Sources
Related briefs
WordPress Core Remote File Inclusion Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-87902). WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. CISA remediation due date: 2026-09-28. If you need help checking exposure, call (864) 335-9223.
WordPress Core Interpretation Conflict Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-63030). WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. CISA remediation due date: 2026-07-24. If you need help checking exposure, call (864) 335-9223.
WordPress Core SQL Injection Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-60137). WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA remediation due date: 2026-08-04. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.