Event Monitor Cyber
EM-20261031-SKO9 VulnerabilityHigh severity

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

CVE-2026-119977 · WordPress WordPress Core

78 hours from first report to confirmed exploitation.

Status
Confirmed

Since : CISA added it to Known Exploited Vulnerabilities.

First Signal
Oct 31 05:33 UTCC41 Red Hat Security Data
Page Born
Oct 31 06:16 UTCsecond source joined
Last Signal
Nov 04 05:43 UTC11 hours before snapshot
Sources
53 official · 2 research, news or crowd
Open For
4 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Oct 31 06:16 UTC
    C6 NVD published
  2. Scored: reached
    Oct 31 06:16 UTC
    CVSS 8.1 · EPSS 1.0%
  3. Exploited: reached
    Nov 03 12:00 UTC
    C1 CISA KEV, fix by 2026-11-06
  4. Advisories: reached
    Nov 03 12:00 UTC
    1 government and CERT sources
  5. Vendor Response: reached
    Oct 31 05:33 UTC
    C41 published
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline 2026-11-06, then 14 quiet days

Timeline

Oct 3112:00Nov 112:00Nov 212:00Nov 312:00Nov 412:00BornConfirmedC41 Red Hat Security DataC6 NVD CVE API 2.0C1 CISA Known Exploited VulnerabilitC2 CISA Cybersecurity AdvisoriesC130 The Hacker News

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades (opens source in a new tab) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity… Med severityResearch & NewsC130 The Hacker News
  2. CISA Adds One Known Exploited Vulnerability to Catalog (opens source in a new tab) CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulne… High severityGovernmentC2 CISA Cybersecurity Advisories
  3. CVE-2026-119977 added to KEV: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (opens source in a new tab) WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predi… High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  4. CVE-2026-119977 (CVSS 8.1) (opens source in a new tab) WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthentic… High severityDatabaseC6 NVD CVE API 2.0
  5. Red Hat: CVE-2026-119977 (important) (opens source in a new tab) wordpress: WordPress: Arbitrary code execution via predictable upgrade staging paths High severityVendorC41 Red Hat Security Data