{"id":"CVE-2026-119977","url":"https://compromised.live/t/CVE-2026-119977","kind":"exploited_vuln","tier":1,"severity":"high","title":"WordPress WordPress Core: WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability","summary":"Attackers can exploit a timing flaw during WordPress core upgrades to run code on the server without logging in, and this is being actively exploited in the wild. WordPress core. Apply the vendor's update now and check for signs of compromise.","summary_source":"ai","affected":[],"epss":null,"kev":{"date_added":"2026-11-03","due_date":"2026-11-06","ransomware":false},"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.","aliases":["CVE-2026-119977"],"sources":[{"name":"kev","id":"CVE-2026-119977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119977"}]}