CISA Confirms Active Exploitation of WordPress Core Race Condition Flaw (CVE-2026-119977)

CISA Adds WordPress Core Vulnerability to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability in WordPress Core to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are actively exploiting the flaw in the wild. The bug, tracked as CVE-2026-119977, carries a CVSS score of 8.1 and stems from a Time-of-check Time-of-use (TOCTOU) race condition that can be leveraged to achieve arbitrary code execution.

WordPress powers a substantial share of the web, so any remotely exploitable flaw in its core codebase draws immediate attention from defenders, hosting providers, and attackers alike. CISA's decision to list the vulnerability signals that exploitation is no longer theoretical — organizations running affected installations should treat patching as urgent.

Understanding the TOCTOU Race Condition

A TOCTOU race condition arises when a program checks a condition (the "time of check") and later acts on it (the "time of use"), but the underlying resource can change between those two moments. In the context of this WordPress Core flaw, the vulnerable window appears to open during software upgrade operations — precisely when files and states are being modified on disk.

An attacker who can reliably win that race can cause the application to operate on a resource in an unintended state, which in this case can escalate into arbitrary code execution. Race conditions are notoriously difficult to defend against because they depend on timing rather than a single malformed input, and they can be inconsistent to reproduce — but that same unpredictability does not make them safe to ignore, as CISA's confirmation of exploitation demonstrates.

Why the Upgrade Path Matters

What makes this vulnerability notable is its association with the software upgrade process itself. Upgrade routines are a trusted, privileged operation inside any content management system, and they often run with elevated filesystem permissions. A flaw that can be triggered during upgrades therefore sits in a sensitive part of the application's lifecycle.

The practical implication is that administrators should be careful about how and when they patch. While the fix for CVE-2026-119977 should be applied as soon as possible, teams should also verify the integrity of their installations and review logs for suspicious activity around upgrade events. Environments that allow untrusted or low-privileged users to influence upgrade-related operations deserve particular scrutiny.

Recommended Defensive Actions

Security teams managing WordPress sites should prioritize the following steps:

• Apply the vendor patch immediately. Update WordPress Core to the latest fixed release and confirm the update completed successfully.
• Verify file integrity. Compare core files against known-good checksums to detect unauthorized modifications that may have occurred through prior exploitation.
• Audit logs for anomalies. Look for unexpected file changes, unusual process activity, or upgrade operations that were not initiated by authorized administrators.
• Restrict privileges. Limit who can trigger upgrades and ensure least-privilege principles apply to hosting accounts and database users.
• Monitor for indicators of compromise. Given confirmed in-the-wild exploitation, treat any signs of tampering as a potential incident and escalate accordingly.

CISA's KEV listing also carries compliance weight for U.S. federal agencies, which are required to remediate cataloged vulnerabilities within set timeframes. For the broader community, the KEV entry is a strong signal that this is not a theoretical risk.

The Bigger Picture

The addition of CVE-2026-119977 to the KEV catalog underscores a recurring theme: widely deployed platforms remain prime targets, and flaws in foundational components like WordPress Core can have outsized impact. Race conditions and other timing-dependent bugs are especially dangerous because they can evade simplistic testing and may be overlooked in code review.

Organizations should use this disclosure as an opportunity to review their patch management cadence, strengthen integrity monitoring, and ensure that upgrade processes are protected as privileged operations. With active exploitation confirmed, speed matters — but so does verifying that a compromise has not already occurred.

For the official advisory and technical details, see the original reporting: CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades.