CISA adds WordPress Core TOCTOU race condition flaw to KEV catalog
What happened.The Cybersecurity and Infrastructure Security Agency added an actively exploited WordPress Core Time-of-check Time-of-use race condition vulnerability to its Known Exploited Vulnerabilities catalog.
Why it matters.Content management systems power publishing estates across enterprises. When predictable directories permit installer execution during upgrades, botnets hijack databases and establish persistent web shells. Engineering teams managing WordPress must upgrade immediately to version 7.1.4. Administrators should configure web servers to block external traffic to the upgrade directory.