WordPress Core vulnerabilities
1 published alerts for WordPress WordPress Core.
Actively exploited (KEV)
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
WordPress WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-119977). WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. CISA remediation due date: 2026-11-06. If you need help checking exposure, call (864) 335-9223.