# CVE-2026-119977: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

- Exploited (CISA KEV): yes, added 2026-11-03
- Published: 2026-10-31
- CVSS: 8.1 HIGH (v3.1)
- EPSS: 0.6% (49th percentile)
- CWE: CWE-367

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

42 posts seen since 2026-11-03.

- mastodon 2026-11-03: Added to CISA's Known Exploited Vulnerabilities catalog: CVE-2026-119977 WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability CVSS 8.1 (High). EPSS 0.6%. US federal agencies must remediate by 2026-11-06. WordPress WordPress Core contains a tim… (https://infosec.exchange/@overflo_ws/117554465092513588)
- hn 2026-11-03: CISA: WordPress core upgrade-window RCE CVE-2026-119977 exploited in the wild (https://news.ycombinator.com/item?id=50357772)
- x 2026-11-03: CISA added WordPress Core CVE-2026-119977 to KEV. A flaw in upgrade staging can allow unauthenticated code execution during updates. Verify 7.1.4 or a fixed branch release and review upgrade logs. #Cybersecurity #Infosec #WordPress  https://t.co/Rz8j0eV2lw (https://x.com/thecyberseckyle/status/2117753785980252528)
- x 2026-11-03: CISA KEV exploited: WordPress core CVE-2026-119977 added Nov 3, federal due date Nov 6. CISA says unauthenticated attackers could run code on the server during the upgrade window. 1. Check Dashboard > Updates 2. Move to 7.1.4+ 3. Older branches: backports are rolling out (https://x.com/cubillas888/status/2117753699669774666)
- x 2026-11-03: WordPress本体の脆弱性（CVE-2026-119977）、1週間見張ってきて「やっぱりきたか...」という気持ち。  ここまでの流れ👇️ 10/28 修正版7.1.4を公開 10/28〜 攻撃の試み（Wordfence・21時間で18,500件超） 10/31 CVE番号が付く（10点満点で8.1） 11/3 (https://x.com/patchkun_jp/status/2117753694645043528)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-119977 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-119977