A critical time-of-check time-of-use (TOCTOU) race condition vulnerability has been identified in WordPress Core, leading to active exploitation in the wild prior to its formal public disclosure. Tracked as CVE-2026-119977, the flaw allows unauthenticated attackers to achieve remote code execution on affected servers. The vulnerability is specifically tied to the predictable, web-accessible staging paths utilized by the platform during full-package core upgrades.
The timeline of the vulnerability indicates a rapid progression from discovery to exploitation. The CVE record was reserved on October 30, 2026, and officially published on October 31, 2026. However, evidence of exploitation in the wild was reported as early as October 30, 2026, meaning the flaw was being leveraged by attackers one day before the vulnerability details were made public.
Multiple security catalogs have confirmed the active exploitation of this flaw. Both the VulnCheck Known Exploited Vulnerabilities (KEV) database and the Cybersecurity and Infrastructure Security Agency (CISA) KEV catalog have listed the vulnerability as exploited. The European Union Agency for Cybersecurity (ENISA) also added the flaw to its EUVD database on November 3, 2026. While these organizations confirm the existence of exploitation, the specific details regarding the identity of the attackers or the scale of the campaign remain unverified.
The vulnerability stems from the way WordPress handles file staging during the update process. Because the staging paths are predictable and accessible via the web, an attacker can time their actions to interact with files during the brief window when the system is performing a check but has not yet finalized the update. This race condition effectively allows for the injection or execution of malicious code before the upgrade process completes.
In response to the threat, CISA has issued a directive requiring federal agencies to apply necessary mitigations in accordance with vendor instructions. This mandate falls under the broader requirements of Binding Operational Directive (BOD) 26-04, which focuses on prioritizing security updates based on risk. Agencies are instructed to evaluate the internet exposure of all affected assets and ensure strict adherence to patching timelines.
The vendor has addressed the issue in WordPress version 7.1.4. Users and administrators are urged to review the official WordPress release announcements and apply the update immediately to close the security gap. For environments where immediate patching is not feasible, stakeholders are advised to follow the specific forensics triage requirements and risk mitigation guidance provided by CISA.
While the technical nature of the TOCTOU flaw is confirmed, the full extent of the exploitation remains a subject of ongoing investigation. The vulnerability has been assigned a high severity rating, and its inclusion in multiple KEV catalogs underscores the urgency for organizations to secure their WordPress installations against potential unauthorized access during the upgrade cycle.
