WordPress Core TOCTOU Race Condition Lets Attackers Slip Code In During Upgrades
What happened
A time-of-check to time-of-use (TOCTOU) race condition in WordPress core, tracked as CVE-2026-119977, was added to CISA's Known Exploited Vulnerabilities (KEV) catalog in early November 2026. The flaw lives in the brief window when WordPress is upgrading itself and staging files in predictable locations.
Why it matters
WordPress runs a massive portion of the web, and the upgrade routine is something every site performs regularly — often automatically. A bug that triggers *during* the upgrade is attractive to attackers because:
- The window is predictable (you know when sites update).
- The staging paths are predictable (the same temp locations every time).
- Many site owners never watch what happens during an update.
- Update WordPress core to the patched release as soon as possible.
- Lock down filesystem permissions so the web user cannot be abused to plant files in staging directories.
- Restrict who can write to the web root — especially shared hosting environments where other tenants may have adjacent access.
- Monitor update events: log when core updates run and alert on unexpected file changes immediately afterward.
How the race works
A TOCTOU bug is a classic concurrency problem: the system checks a condition (for example, "this file is the legitimate upgrade payload") and then uses the file a moment later. If an attacker can swap the file in between the check and the use, the system acts on attacker-controlled content.
In this case, because the staging paths used during the upgrade are predictable, an attacker who can write to that location at the right instant can introduce their own code, which WordPress then executes as part of finishing the upgrade.
How to defend
What it means for you
Race conditions are one of the hardest bug classes to reason about because the "wrong" behavior only appears under specific timing. This is a great real-world example to study if you are learning application security: the individual steps look safe in isolation, but the gap between them is the vulnerability.