WordPress Core CVE-2026-119977: race condition exploited

What it is and who is affectedWordPress Core carries a time-of-check time-of-use (TOCTOU) race condition tracked as CVE-2026-119977, catalogued as CWE...

What it is and who is affected

WordPress Core carries a time-of-check time-of-use (TOCTOU) race condition tracked as CVE-2026-119977, catalogued as CWE-367. According to the National Vulnerability Database (NVD) of NIST, the flaw exposes WordPress Core versions 4.7 through 7.1.3 to remote code execution. The root cause is described as predictable, web-accessible staging paths used during full-package core upgrades: an attacker can act on files in that staging area between the moment they are checked and the moment they are used, and run code on the server during the upgrade window.

No authentication is required. The CVSS 3.1 score is 8.1, HIGH (vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), published in the NVD on 31 October 2026. In plain terms: any small business in Barcelona, Lleida, Tarragona or Girona running an outdated WordPress core on a public server is in scope, and so is any online shop or corporate site built on it. The high attack complexity in the vector does not make it harmless — it makes it a question of timing, and timing can be waited out.

Why it is urgent: already exploited in real attacks

This is not a theoretical flaw. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities (KEV) catalogue on 3 November 2026, which means there is evidence of exploitation in the wild. For US federal agencies, CISA set a remediation deadline of 6 November 2026 and requires mitigations to be applied in line with vendor instructions, under its BOD 26-04 guidance on prioritising security updates by risk, including the obligation to assess each asset's internet exposure.

That three-day window is a useful signal for everyone else. When a catalogue of this kind moves that fast, the practical reading for a Spanish pyme is simple: the gap between disclosure and attempted exploitation has collapsed. The material does not record this vulnerability as used in ransomware campaigns, so there is no need to assume the worst — but "not yet linked to ransomware" is not a reason to wait. The upgrade window is the attack window, and core updates happen on a schedule that attackers can observe.

What to do today

Find out what you are running. Check the exact WordPress Core version on every site you own or host. Anything from 4.7 up to and including 7.1.3 falls inside the affected range. Do not rely on memory or on a dashboard that may be stale.
Apply the fix the vendor indicates. Follow the official WordPress security advisory for the corrected release and the recommended upgrade procedure. The material does not specify which version resolves the issue, so take the version and steps from the vendor's own notice rather than from a third-party summary.
Do not leave staging paths exposed. Because the flaw depends on web-accessible staging paths during full-package upgrades, review what your web server actually serves during and after an update, and block public access to anything that should not be reachable.
Look for signs of intrusion. Review server and web logs around recent core upgrade windows for unexpected file creation, requests to staging locations, or unfamiliar processes. Compare core files against a clean copy of the same version.
Reduce what is exposed to the internet. Administrative panels, staging copies and development environments do not need to be publicly reachable. Restrict them by IP or VPN, and keep a recent, tested backup before you touch anything.

If you run PrestaShop or Joomla alongside WordPress, the same discipline applies: know your versions, know your exposure, and treat every update window as a moment when someone may be watching.

How a cybersecurity team such as ALMC's can help

Most small teams we work with in Catalonia have one person wearing several hats, and keeping a patch calendar across a handful of WordPress, PrestaShop and Joomla sites is exactly the task that slips. That is the gap ALMC's cybersecurity work is built to close: security audits and pentesting to find what is exposed before someone else does, server hardening to remove predictable, web-reachable paths, and monitoring with incident response so that unusual activity during an upgrade does not go unnoticed.

We also handle the unglamorous part — maintenance and updating of WordPress, PrestaShop and Joomla, under GDPR-aware procedures — and we repair websites that have already been hacked. When a flaw like CVE-2026-119977 is being exploited in the wild, the difference between a bad week and a business interruption is usually whether someone checked the version number in time.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.