WordPress Core TOCTOU Vulnerability Allows Remote Code Execution

A time-of-check time-of-use (TOCTOU) race condition in WordPress Core, tracked as CVE-2026-119977, allows unauthenticated remote attackers to execute arbitrary code on vulnerable web servers. The security flaw stems from predictable, web-accessible staging paths used during full-package core upgrades. By timing HTTP requests to coincide with an active update cycle, an attacker can access and execute staging assets before final permission checks and file moves take effect.

Mechanics of the Staging Flaw

When WordPress Core executes a full update, it retrieves and extracts the core package archive into a temporary staging location—typically within the wp-content/upgrade/ directory—before replacing existing production files. Because these staging locations are placed within the web root and follow predictable directory structures, the file extraction routine introduces a TOCTOU window (classified under CWE-367).

An unauthenticated attacker who monitors or triggers an update cycle can send high-frequency HTTP requests targeting predictable files within the extraction path. If a request hits a staged PHP file after it has been unpacked but before WordPress finishes moving the files and cleaning up the staging directory, the web server processes the payload. Because the operation requires no pre-existing session or elevated role, a successful race condition results in full code execution in the context of the web server process.

Exposure and Operational Risk

The vulnerability carries a CVSS score of 8.1, defined by the metric vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The High Attack Complexity (AC:H) rating reflects the precise timing required to exploit the race condition while an update is actively processing. However, the lack of required privileges (PR:N) and user interaction (UI:N) makes the flaw attractive for automated exploitation scripts designed to watch for site update markers.

Currently, the measured EPSS score sits at 0.60% (placing it in the 48.8th percentile across all tracked CVEs). This indicates that while mass, opportunistic exploitation across the broader web remains moderate compared to static unauthenticated endpoints, the operational threat spikes significantly for high-traffic sites, managed hosting platforms, or environments using automated core update schedules.

Targeted Remediation and Forensics

Administrators and security teams should apply the official vendor security update for WordPress Core immediately. Beyond applying the core software update, hosting environments and site operators should implement the following targeted defensive measures:

• Restrict HTTP Access to Staging Directories: Update web server rules (Nginx, Apache, or IIS) to block all direct web requests to temporary upgrade directories, specifically denying public access to /wp-content/upgrade/ and its subdirectories.
• Harden Execution Permissions: Ensure that directory-level permissions prevent script execution inside temporary upload and upgrade paths across the entire web root.
• Forensic Triage and Verification: Audit web server access logs around historical update windows for anomalous GET or POST requests directed at temporary upgrade subdirectories. Look for unexpected PHP execution logs originating from /wp-content/upgrade/.

In alignment with federal risk management timelines such as BOD 26-04, organizations managing exposed internet assets must ensure patches or web server mitigations are fully deployed by November 6, 2026.