CVE-2026-119977
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
8.1CVSS base score · high (NVD)
0.6%Chance of exploitation in the next 30 days (FIRST EPSS)
ExploitedIn CISA KEV · federal patch deadline Nov 6, 2026
What happened
WordPress Core contains a time-of-check time-of-use race condition vulnerability allowing unauthenticated remote code execution during upgrade windows via predictable staging paths. CISA added it to the Known Exploited Vulnerabilities catalog with a federal patching deadline of November 6, 2026. Administrators must apply patches immediately and evaluate internet exposure per BOD 26-04 guidance.
From the Intel60 brief of Nov 3, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalWordPress Core TOCTOU flaw added to CISA KEVNov 3, 2026