CVE Details
CVE-2026-119977
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
Published: 2026-11-03
CVSS: 8.1 HIGH
Product: WordPress WordPress Core
Due Date: 2026-11-06
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
GitHub PoC
Warning: GitHub PoC repositories are unverified. Some may be fake
or contain malware. Use caution and review code before running anything.
No GitHub PoC data.
FIRST EPSS
EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.
Timeline
CVE Stalker
KEV
MITRE
GitHub
FIRST (EPSS)
MITRE
CVSS
SSVC
References
Show Raw Data
| Key | Remaining Key | Value |
|---|---|---|
| dataType | CVE_RECORD | |
| dataVersion | 5.2 | |
| cveMetadata > | cveId | CVE-2026-119977 |
| cveMetadata > | assignerOrgId | b15e7b5b-3da4-40ae-a43c-f7aa60e62599 |
| cveMetadata > | state | PUBLISHED |
| cveMetadata > | assignerShortName | Wordfence |
| cveMetadata > | dateReserved | 2026-10-30T17:17:35.145Z |
| cveMetadata > | datePublished | 2026-10-31T05:33:07.059Z |
| cveMetadata > | dateUpdated | 2026-10-31T05:33:07.059Z |
| containers > | cna > providerMetadata > orgId | b15e7b5b-3da4-40ae-a43c-f7aa60e62599 |
| containers > | cna > providerMetadata > shortName | Wordfence |
| containers > | cna > providerMetadata > dateUpdated | 2026-10-31T05:33:07.059Z |
| containers > | cna > affected > 0 > vendor | WordPress Foundation |
| containers > | cna > affected > 0 > product | WordPress |
| containers > | cna > affected > 0 > versions > 0 > version | 4.7.0 |
| containers > | cna > affected > 0 > versions > 0 > status | affected |
| containers > | cna > affected > 0 > versions > 0 > lessThanOrEqual | 4.7.38 |
| containers > | cna > affected > 0 > versions > 0 > versionType | semver |
| containers > | cna > affected > 0 > versions > 1 > version | 4.8.0 |
| containers > | cna > affected > 0 > versions > 1 > status | affected |
| containers > | cna > affected > 0 > versions > 1 > lessThanOrEqual | 4.8.33 |
| containers > | cna > affected > 0 > versions > 1 > versionType | semver |
| containers > | cna > affected > 0 > versions > 2 > version | 4.9.0 |
| containers > | cna > affected > 0 > versions > 2 > status | affected |
| containers > | cna > affected > 0 > versions > 2 > lessThanOrEqual | 4.9.34 |
| containers > | cna > affected > 0 > versions > 2 > versionType | semver |
| containers > | cna > affected > 0 > versions > 3 > version | 5.0.0 |
| containers > | cna > affected > 0 > versions > 3 > status | affected |
| containers > | cna > affected > 0 > versions > 3 > lessThanOrEqual | 5.0.30 |
| containers > | cna > affected > 0 > versions > 3 > versionType | semver |
| containers > | cna > affected > 0 > versions > 4 > version | 5.1.0 |
| containers > | cna > affected > 0 > versions > 4 > status | affected |
| containers > | cna > affected > 0 > versions > 4 > lessThanOrEqual | 5.1.27 |
| containers > | cna > affected > 0 > versions > 4 > versionType | semver |
| containers > | cna > affected > 0 > versions > 5 > version | 5.2.0 |
| containers > | cna > affected > 0 > versions > 5 > status | affected |
| containers > | cna > affected > 0 > versions > 5 > lessThanOrEqual | 5.2.29 |
| containers > | cna > affected > 0 > versions > 5 > versionType | semver |
| containers > | cna > affected > 0 > versions > 6 > version | 5.3.0 |
| containers > | cna > affected > 0 > versions > 6 > status | affected |
| containers > | cna > affected > 0 > versions > 6 > lessThanOrEqual | 5.3.26 |
| containers > | cna > affected > 0 > versions > 6 > versionType | semver |
| containers > | cna > affected > 0 > versions > 7 > version | 5.4.0 |
| containers > | cna > affected > 0 > versions > 7 > status | affected |
| containers > | cna > affected > 0 > versions > 7 > lessThanOrEqual | 5.4.24 |
| containers > | cna > affected > 0 > versions > 7 > versionType | semver |
| containers > | cna > affected > 0 > versions > 8 > version | 5.5.0 |
| containers > | cna > affected > 0 > versions > 8 > status | affected |
| containers > | cna > affected > 0 > versions > 8 > lessThanOrEqual | 5.5.23 |
| containers > | cna > affected > 0 > versions > 8 > versionType | semver |
| containers > | cna > affected > 0 > versions > 9 > version | 5.6.0 |
| containers > | cna > affected > 0 > versions > 9 > status | affected |
| containers > | cna > affected > 0 > versions > 9 > lessThanOrEqual | 5.6.22 |
| containers > | cna > affected > 0 > versions > 9 > versionType | semver |
| containers > | cna > affected > 0 > versions > 10 > version | 5.7.0 |
| containers > | cna > affected > 0 > versions > 10 > status | affected |
| containers > | cna > affected > 0 > versions > 10 > lessThanOrEqual | 5.7.20 |
| containers > | cna > affected > 0 > versions > 10 > versionType | semver |
| containers > | cna > affected > 0 > versions > 11 > version | 5.8.0 |
| containers > | cna > affected > 0 > versions > 11 > status | affected |
| containers > | cna > affected > 0 > versions > 11 > lessThanOrEqual | 5.8.18 |
| containers > | cna > affected > 0 > versions > 11 > versionType | semver |
| containers > | cna > affected > 0 > versions > 12 > version | 5.9.0 |
| containers > | cna > affected > 0 > versions > 12 > status | affected |
| containers > | cna > affected > 0 > versions > 12 > lessThanOrEqual | 5.9.19 |
| containers > | cna > affected > 0 > versions > 12 > versionType | semver |
| containers > | cna > affected > 0 > versions > 13 > version | 6.0.0 |
| containers > | cna > affected > 0 > versions > 13 > status | affected |
| containers > | cna > affected > 0 > versions > 13 > lessThanOrEqual | 6.0.17 |
| containers > | cna > affected > 0 > versions > 13 > versionType | semver |
| containers > | cna > affected > 0 > versions > 14 > version | 6.1.0 |
| containers > | cna > affected > 0 > versions > 14 > status | affected |
| containers > | cna > affected > 0 > versions > 14 > lessThanOrEqual | 6.1.15 |
| containers > | cna > affected > 0 > versions > 14 > versionType | semver |
| containers > | cna > affected > 0 > versions > 15 > version | 6.2.0 |
| containers > | cna > affected > 0 > versions > 15 > status | affected |
| containers > | cna > affected > 0 > versions > 15 > lessThanOrEqual | 6.2.14 |
| containers > | cna > affected > 0 > versions > 15 > versionType | semver |
| containers > | cna > affected > 0 > versions > 16 > version | 6.3.0 |
| containers > | cna > affected > 0 > versions > 16 > status | affected |
| containers > | cna > affected > 0 > versions > 16 > lessThanOrEqual | 6.3.13 |
| containers > | cna > affected > 0 > versions > 16 > versionType | semver |
| containers > | cna > affected > 0 > versions > 17 > version | 6.4.0 |
| containers > | cna > affected > 0 > versions > 17 > status | affected |
| containers > | cna > affected > 0 > versions > 17 > lessThanOrEqual | 6.4.13 |
| containers > | cna > affected > 0 > versions > 17 > versionType | semver |
| containers > | cna > affected > 0 > versions > 18 > version | 6.5.0 |
| containers > | cna > affected > 0 > versions > 18 > status | affected |
| containers > | cna > affected > 0 > versions > 18 > lessThanOrEqual | 6.5.13 |
| containers > | cna > affected > 0 > versions > 18 > versionType | semver |
| containers > | cna > affected > 0 > versions > 19 > version | 6.6.0 |
| containers > | cna > affected > 0 > versions > 19 > status | affected |
| containers > | cna > affected > 0 > versions > 19 > lessThanOrEqual | 6.6.10 |
| containers > | cna > affected > 0 > versions > 19 > versionType | semver |
| containers > | cna > affected > 0 > versions > 20 > version | 6.7.0 |
| containers > | cna > affected > 0 > versions > 20 > status | affected |
| containers > | cna > affected > 0 > versions > 20 > lessThanOrEqual | 6.7.10 |
| containers > | cna > affected > 0 > versions > 20 > versionType | semver |
| containers > | cna > affected > 0 > versions > 21 > version | 6.8.0 |
| containers > | cna > affected > 0 > versions > 21 > status | affected |
| containers > | cna > affected > 0 > versions > 21 > lessThanOrEqual | 6.8.11 |
| containers > | cna > affected > 0 > versions > 21 > versionType | semver |
| containers > | cna > affected > 0 > versions > 22 > version | 6.9.0 |
| containers > | cna > affected > 0 > versions > 22 > status | affected |
| containers > | cna > affected > 0 > versions > 22 > lessThanOrEqual | 6.9.10 |
| containers > | cna > affected > 0 > versions > 22 > versionType | semver |
| containers > | cna > affected > 0 > versions > 23 > version | 7.0.0 |
| containers > | cna > affected > 0 > versions > 23 > status | affected |
| containers > | cna > affected > 0 > versions > 23 > lessThanOrEqual | 7.0.7 |
| containers > | cna > affected > 0 > versions > 23 > versionType | semver |
| containers > | cna > affected > 0 > versions > 24 > version | 7.1.0 |
| containers > | cna > affected > 0 > versions > 24 > status | affected |
| containers > | cna > affected > 0 > versions > 24 > lessThanOrEqual | 7.1.3 |
| containers > | cna > affected > 0 > versions > 24 > versionType | semver |
| containers > | cna > affected > 0 > defaultStatus | unaffected |
| containers > | cna > descriptions > 0 > lang | en |
| containers > | cna > descriptions > 0 > value | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. |
| containers > | cna > title | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution |
| containers > | cna > references > 0 > url | https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve |
| containers > | cna > references > 1 > url | https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378 |
| containers > | cna > references > 2 > url | https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162 |
| containers > | cna > references > 3 > url | https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549 |
| containers > | cna > references > 4 > url | https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282 |
| containers > | cna > references > 5 > url | https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346 |
| containers > | cna > references > 6 > url | https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545 |
| containers > | cna > references > 7 > url | https://wordpress.org/news/2026/10/wordpress-7-1-4/ |
| containers > | cna > problemTypes > 0 > descriptions > 0 > lang | en |
| containers > | cna > problemTypes > 0 > descriptions > 0 > description | CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition |
| containers > | cna > problemTypes > 0 > descriptions > 0 > cweId | CWE-367 |
| containers > | cna > problemTypes > 0 > descriptions > 0 > type | CWE |
| containers > | cna > metrics > 0 > cvssV3_1 > version | 3.1 |
| containers > | cna > metrics > 0 > cvssV3_1 > vectorString | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| containers > | cna > metrics > 0 > cvssV3_1 > baseScore | 8.1 |
| containers > | cna > metrics > 0 > cvssV3_1 > baseSeverity | HIGH |
| containers > | cna > credits > 0 > lang | en |
| containers > | cna > credits > 0 > type | finder |
| containers > | cna > credits > 0 > value | Umut Bayram |
| containers > | cna > timeline > 0 > time | 2026-10-28T00:00:00.000Z |
| containers > | cna > timeline > 0 > lang | en |
| containers > | cna > timeline > 0 > value | Disclosed |