Browse / CVEs / CVE-2026-119977
CVE-2026-119977· wordpress / wordpress core· CWE-367
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Exploited in the wild. Listed by CISA on 2026-11-03; known to be used by ransomware.
1.2%likelihood of exploitation, next 30 days
69%of all CVEs are less likely
Nonecheck to confirm it
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
No ready check is stored for this CVE. Confirm it by hand from the references.
References
Use this check only on systems you are authorised to test. Where the data comes from