CISAAnalysisCISA adds WordPress Core TOCTOU race condition flaw to KEV catalog
What happened.The Cybersecurity and Infrastructure Security Agency added an actively exploited WordPress Core Time-of-check Time-of-use race condition vulnerability to its Known Exploited Vulnerabilities catalog.
Why it matters.Content management systems power publishing estates across enterprises. When predictable directories permit installer execution during upgrades, botnets hijack databases and establish persistent web shells. Engineering teams managing WordPress must upgrade immediately to version 7.1.4. Administrators should configure web servers to block external traffic to the upgrade directory.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-119977 with an 8.1 CVSS score, the defect exists in upgrade unpacking across WordPress 4.7.0 through 7.1.3.
- Web-accessible staging: Full core updates unpack files into predictable paths under wp-content/upgrade, exposing the unauthenticated setup-config.php installer.
- Race condition: Because staging lacks wp-config.php, unauthenticated callers timing requests during updates trigger fresh installs to overwrite configurations and execute code.
- Observed exploitation: Telemetry identified automated in-the-wild probes targeting exposed staging paths across internet-facing sites.
- Remediation releases: WordPress released version 7.1.4 and backported updates, advising teams to block public access to wp-content/upgrade during updates.