WordPress core race condition lets attackers run code during upgrades, actively exploited

What happened

On 31 October 2026 a vulnerability in WordPress core became public, tracked as CVE-2026-119977. It is a time-of-check time-of-use (TOCTOU) race condition in the way WordPress performs full-package core upgrades. During such an upgrade, WordPress uses staging paths that are predictable and reachable over the web. An unauthenticated attacker who hits these paths during the upgrade window can execute code on the server.

On 3 November 2026 CISA added the vulnerability to its catalogue of actively exploited vulnerabilities. Attacks are therefore happening now. No CVSS score has been published yet.

Who is affected

All WordPress installations running an affected core version are at risk, regardless of theme or plugins. The attack does not need a login. The vulnerable moment is the full-package core upgrade itself, so sites that update core automatically or on a schedule are exposed every time such an upgrade runs.

The vendor release announcement linked below refers to WordPress 7.1.4. Check it and the linked advisories for the exact affected and fixed versions, including any fixes for older branches.

What to do now

1. Make a quick backup of the site files, wp-config.php and the database.
2. Check the vendor advisory linked below and identify the fixed version for the branch you run.
3. Update WordPress core to the fixed version, for example with wp core update via WP-CLI or from the dashboard. Because the weakness lies in the upgrade window, run the update at a quiet time and do not leave it half finished.
4. If you manage many sites, update them promptly and in a controlled way rather than waiting for scheduled automatic updates.
5. After the update, confirm the version with wp core version, load the front end and the admin area, and check the PHP and web server error logs.
6. If a site ran a core upgrade on an affected version recently, carry out the checks below even after updating, since a compromise during an earlier upgrade is not undone by the patch.

How to check whether you are affected

• Check the installed core version with wp core version or under Dashboard > Updates and compare it with the fixed versions in the vendor advisory.
• Review the web server access logs around the times of recent core upgrades for requests from unknown addresses to the upgrade staging area (by default below wp-content/upgrade/).
• Look for leftover or unexpected files in wp-content/upgrade/ and for recently changed PHP files in the web root, for example with find . -name '*.php' -mtime -7.
• Run wp core verify-checksums to detect modified core files.
• Check for unknown administrator accounts (wp user list --role=administrator), unknown scheduled tasks and unfamiliar plugins.
• If you find signs of compromise, take the site offline, preserve the logs for analysis, restore from a clean backup, update, and change all passwords and the keys and salts in wp-config.php.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-119977
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog