CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

RBRecent Breaches Vulnerability Intelligence·Nov 3, 2026

CVSS 8.1 · High⚠ Actively exploited (CISA KEV)

8.1

CVSS score

High

Severity

Active

CISA KEV

Ransomware use

Nov 6, 2026

Patch deadline

⚠ Exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on Nov 3, 2026, with a federal patch deadline of Nov 6, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

Details

AffectedWordPress · WordPress Core

WeaknessCWE-367

CVSS base score8.1 (High)

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedOct 31, 2026

Added to CISA KEVNov 3, 2026

Federal patch deadlineNov 6, 2026

Known ransomware useNot documented

Check if your data is exposed →

Frequently asked questions

Is CVE-2026-119977 being actively exploited?

Yes — CISA lists CVE-2026-119977 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2026-119977 affect?

CVE-2026-119977 affects WordPress · WordPress Core.

How do I fix CVE-2026-119977?

Apply the vendor’s patch for the affected software. The federal patch deadline was Nov 6, 2026. Then check whether your personal data was exposed in any related breach.

References

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities