CISA Adds WordPress Core TOCTOU Vulnerability CVE-2026-119977 to KEV Catalog

What happened

On 2026-??, CISA announced the addition of CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. The entry describes a time‑of‑check to time‑of‑use race condition in WordPress core that has been actively exploited in the wild.

Evidence shows that attackers can trigger the flaw by manipulating file‑system operations during plugin or theme updates, leading to arbitrary code execution with full control of the affected WordPress installation.

Who is affected

Any organization running WordPress that has not applied the latest security patch is at risk. The vulnerability is present in all WordPress core releases prior to the patch issued in the 6.5.0 update.

Publicly exposed sites, especially those that allow remote file uploads or administrative access over the internet, are the most likely targets for exploitation.

Impact

Successful exploitation grants the attacker complete control over the web server, enabling data exfiltration, credential theft, and the deployment of additional malware.

Because the flaw is a TOCTOU race, detection is difficult; attackers can execute code without triggering obvious alerts, making post‑compromise detection challenging.

Exposure

Attackers have leveraged the flaw in several high‑profile phishing campaigns, using malicious URLs that trigger the race condition during a routine WordPress update.

Indicators of compromise include unexpected changes to core files, the presence of unfamiliar PHP scripts, and sudden spikes in outbound traffic from the web server.

What to do

Defenders should immediately verify the WordPress version on all sites and apply the latest security patch (6.5.0 or newer). If a patch cannot be applied, consider temporarily disabling automatic updates and monitoring for suspicious activity.

Implement the following actions:

• Run a full file integrity check against the official WordPress core checksum.
• Block or monitor the /wp-admin/update.php endpoint for abnormal access patterns.
• Apply the patch in a staging environment first, then deploy to production after validation.
• Enable logging for file system changes and review logs for race‑condition indicators.
• Educate administrators about the risk of enabling remote file uploads during updates.

What to watch

Keep an eye on the CISA KEV catalog for new additions that may affect other CMS platforms. Monitor threat intelligence feeds for exploitation attempts targeting WordPress update mechanisms.

Watch for:

• New CVE entries that reference TOCTOU or race conditions in web application core code.
• Indicators of automated update abuse in public repositories.
• Emerging malware that leverages WordPress core vulnerabilities for persistence.