Vulnerability intelligence

CVE-2026-119977: TOCTOU in WordPress Core upgrades

A sourced analysis of CVE-2026-119977, a WordPress Core upgrade-window remote-code-execution issue, including affected versions, CNA scoring and CISA KEV status.

IRIROSG Editorial·2026-11-03·1 min read·96 body words

CVE-2026-119977: TOCTOU in WordPress Core upgrades

IdentifierCVE-2026-119977

Vendor / productWordPress Foundation / WordPress Core

Severity scoreCVSS 8.1

Added to CISA KEV2026-11-03

A KEV listing indicates evidence of real-world exploitation—not that every installation is compromised. Check your version, configuration and the vendor’s advisory.

CVE-2026-119977 affects WordPress Core upgrade handling. NVD describes a time-of-check/time-of-use race condition involving predictable, web-accessible staging paths during a full-package core upgrade, creating a remote-code-execution risk during the upgrade window.

This advisory separates the NVD description from the CNA-provided CVSS 3.1 score, explains the CISA Known Exploited Vulnerabilities listing and its remediation deadline, and summarizes the vendor's WordPress 7.1.4 security release. Administrators should update through official WordPress channels, verify the installed version, review upgrade activity and investigate unexpected files or processes.

This page provides a concise English summary. The full long-form analysis is currently available in Persian.

TRACEABLE KNOWLEDGE

Sources & further reading

NVD — صفحهٔ جزئیات CVE-2026-119977https://nvd.nist.gov/vuln/detail/cve-2026-119977

WordPress Trac — کد ارتقای هسته، برچسب 7.1.3https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162

WordPress Trac — اصلاح update-core در 7.1.4https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545

CISA Known Exploited Vulnerabilities Catalog — CVE-2026-119977https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977

WordPress.org — یادداشت انتشار 7.1.4https://wordpress.org/news/2026/10/wordpress-7-1-4/

IROSG / EDITORIAL

News and pioneer profiles use original writing with source attribution. Image credits and licenses are kept in each page’s sources section instead of beneath the images. CVE reference data credits its primary sources.

Editorial and image policy ↗