> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # WordPress Core TOCTOU race condition CVE-2026-119977 added to CISA KEV - URL: https://f4n6.co.uk/security-feed/wordpress-core-toctou-race-condition-cve-2026-119977-added-to-cisa-kev/ - Published: 2026-11-04T09:44:40.000Z - Updated: 2026-11-04T09:44:40.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-119977 ## 1\. Executive summary CISA added CVE-2026-119977, a time-of-check time-of-use race condition in WordPress Core, to the Known Exploited Vulnerabilities catalog on 2026-11-03, citing evidence of active exploitation. NVD scores it CVSS 8.1 HIGH (CWE-367); EPSS is 1%. The flaw lets an unauthenticated attacker execute code on the server during a full-package core upgrade, because WordPress unpacks new files into a predictable, web-accessible staging path that can be reached before cleanup. Any EMEA financial services firm running self-hosted WordPress, including marketing sites, intranet portals and supplier-facing microsites, should treat internet-facing instances as exposed and move to a fixed release now. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | CISA records active exploitation of a component (WordPress Core) that many firms run on internet-facing infrastructure, and the vendor fix is a core upgrade. | Firms must be able to detect and manage an exploitation attempt against their own WordPress estate through their incident process, not only patch it. | | DORA Art. 28: ICT third-party risk — general principles | WordPress Core is third-party software, and where hosting or maintenance is outsourced the exposure sits with a provider. | Confirm the provider has applied the fixed release and can evidence it; the obligation is on the firm regardless of who runs the site. | | NIS2 Art. 21(2)(d): supply chain security measures | The vulnerability is in a third-party component (WordPress Core) used across the estate. | Supply chain security measures must cover the WordPress core version actually deployed, including managed-hosting arrangements. | ## 3\. Technical analysis & attack chain The vulnerability is a TOCTOU race condition in the WordPress Core full-package upgrade process. During an upgrade, WordPress unpacks the new files into a staging directory that is predictable and reachable over the web on many server configurations. An attacker who can reach that staging tree while the upgrade is in progress can cause code to execute on the server. No authentication on the WordPress site is required. Confirmed steps, from Defiant's account as reported by SecurityWeek: 1. A full-package core update runs on the target, unpacking installer files into the staging directory. 2. The attacker, who needs public web and PHP access to the staging tree plus a predictable or discovered staging path, requests the staged files directly. 3. The attacker reaches the staged installer before WordPress cleans up the temporary files, a window Defiant describes as seconds long, and achieves code execution. Defiant's preconditions are specific: a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to finish before cleanup. Attack complexity is high, and the exploitability window is narrow. The attacker does not need an account on the site. The fix, shipped in WordPress 7.1.4 and backported to branches through WordPress 4.7, randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data. WordPress 7.1.4 also carries patches for 22 security defects, among them several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug and an authorization weakness, and updates the bundled root certificates for the recent eMudhra revocation. Exploitation is underway. Defiant reports that Wordfence telemetry recorded more than 18,500 requests targeting staged `setup-config.php` installer paths in the first 21 hours after its firewall rule deployed, with the first match arriving nine minutes after deployment. Attackers poll the vulnerable paths repeatedly to hit the seconds-long window. Wordfence has not reported a successful compromise. These figures are single-sourced to Defiant via SecurityWeek; treat them as one vendor's telemetry. Two points of care. SecurityWeek's report predates CVE assignment and describes the flaw without an identifier; it matches CVE-2026-119977 on product, mechanism and fix version, and is treated here as the same event. No source names an actor, a victim, a payload, a persistence mechanism or post-exploitation activity, so none is asserted. The other WordPress Core CVEs in the KEV catalog (CVE-2026-60137, CVE-2026-63030, CVE-2026-87902) are separate vulnerabilities with their own due dates and are not part of this event. ## 4\. Mitigation & containment P1 (within 24 hours) - Upgrade WordPress Core to 7.1.4, or to the current release on your branch, which carries the backport for branches through 4.7\. This is the only remediation the sources name. - Inventory every self-hosted WordPress instance and mark which are internet-facing. Prioritise those that run full-package core updates rather than incremental ones, since the exploit needs a full-package update. - Where upgrade cannot happen immediately, block web access to the core staging directory at the reverse proxy or WAF. The sources do not give the staging path string, so derive it from your own WordPress configuration rather than guessing. - Search web logs for requests to staged `setup-config.php` installer paths and for repeated polling of the same path. Treat a hit during an upgrade window as a possible exploitation attempt and escalate. P2 (within 72 hours) - Confirm managed-hosting and maintenance providers have applied 7.1.4 or the branch backport, and obtain evidence of the version running. - Review file integrity on any instance that was mid-upgrade while internet-facing, focusing on files written under the staging tree and any promotion of staged configuration data. P3 (within 7 days) - Schedule core upgrades so they do not run unattended on internet-facing hosts, and restrict PHP execution in upload and staging directories. - Track the 22 other defects fixed in 7.1.4 through normal patch governance; they are not covered by this advisory's exploitation facts. No fixed release is named for any branch older than 4.7. ## 5\. Indicators of compromise No atomic indicators of compromise are available in the source material. The only observable given is behavioural: HTTP requests to staged `setup-config.php` installer paths under the WordPress core staging tree, repeated polling of those paths, and the first such request arriving during an upgrade window. ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------- | ---------------------------------------------------- | --------------------------------------------------- | | Requests to staged setup-config.php installer paths | Web server access logs, reverse proxy and WAF logs | Medium (single-sourced to Defiant via SecurityWeek) | | Repeated polling of the same staging path in a short interval | Web server access logs, rate-limit and WAF telemetry | Medium (single-sourced) | | Staging-path requests clustered around a core upgrade window | Correlated web logs and WordPress upgrade logs | Medium (single-sourced) | ## 6\. Detection The sources give no file artefacts, hashes, command lines or registry keys, so a YARA rule would have nothing genuine to match. Detection rests on the request behaviour above. ```yaml title: WordPress Core staging setup-config.php access during upgrade window id: 7c1e9a52-3b4d-4f18-9a6e-2d5c8b0f4e71 status: experimental description: Detects HTTP requests to a staged setup-config.php installer path under a WordPress core staging tree, the access pattern Defiant reported against CVE-2026-119977. author: Adverse Trace date: 2026-11-04 references: - https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/ - https://nvd.nist.gov/vuln/detail/CVE-2026-119977 logsource: category: webserver detection: selection_uri: cs-uri-stem|endswith: '/setup-config.php' selection_staging: cs-uri-stem|contains: '/wp-content/upgrade/' condition: selection_uri and selection_staging fields: - c-ip - cs-uri-stem - sc-status falsepositives: - Legitimate WordPress core upgrade traffic from the host itself level: high ``` The `/wp-content/upgrade/` path is the standard WordPress upgrade working directory, not a string quoted in the sources; validate it against your deployment before enabling, and tune out requests originating from the web server's own address during scheduled upgrades. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | -------- | ---------------- | ---- | --------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-119977](https://nvd.nist.gov/vuln/detail/CVE-2026-119977?ref=f4n6.co.uk) | 8.1 High | ⚠ KEV 2026-11-03 | 1% | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3\. This is due to predictable, web-accessible… | ## 7\. Sources - NVD, CVE-2026-119977 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-119977, 2026-11-03 - The Hacker News, CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades, https://thehackernews.com/2026/11/cisa-confirms-hackers-exploiting.html - SecurityWeek, Fresh WordPress Vulnerability in Attackers' Crosshairs, https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/ ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-119977 as CVSS 8.1 HIGH, in CISA KEV since 2026-11-03, with EPSS at 1% and no ransomware use recorded. Exploitation is confirmed by CISA and by Defiant's telemetry, but no successful compromise has been reported and no actor is named, so attribution is unconfirmed. The client risk is concentrated in internet-facing, self-hosted WordPress that runs full-package core upgrades, and the exposure is bounded by the narrow exploit window and high attack complexity. The Defiant request counts are single-sourced; verify before enforcing blocks on them. We will track for a named actor, a confirmed victim or a published staging-path string, and will update this advisory if any of those appear. Clients should confirm their WordPress core version and their hosting provider's patch state this week. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-119977?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*