WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

What's happening and what to do

Attackers can exploit a timing flaw during WordPress core upgrades to run code on the server without logging in, and this is being actively exploited in the wild. WordPress core. Apply the vendor's update now and check for signs of compromise.

AI summary of the sources on this page. Regenerated when a source changes.

Signals over time

2026-11-03Added to CISA's Known Exploited Vulnerabilities catalog.
2026-11-03 21:55First seen here.
2026-11-06Federal patch deadline for US agencies.

Source text

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.