WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CVE-2026-119977) is being actively exploited, CISA warns
CISA added CVE-2026-119977 (WordPress WordPress Core) to its Known Exploited Vulnerabilities catalog on November 3, 2026, which means there is reliable evidence of exploitation in the wild. WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable…
Excerpt from the primary source: CISA Known Exploited Vulnerabilities
Who is affected
Small businesses · Enterprises · Developers · Security professionals
Affected technology: WordPress, WordPress Core
Why it matters
CISA lists this as exploited in the wild. Unpatched WordPress and WordPress Core systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Patch
Apply the vendor's security update for WordPress and WordPress Core. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
CISA's required action for CVE-2026-119977: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." US federal civilian agencies must comply by November 6, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.
Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.