WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 3 Nov 2026.
0.60%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-119977. Nothing runs until you send it.
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
You are affected if
The fix