CVE-2026-119977: WordPress Core Flaw Hits CISA KEV

On 3 November 2026, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog under catalog version 2026.11.03. It is a time-of-check time-of-use race condition in WordPress core that, in CISA's wording, "could allow unauthenticated attackers to execute code on the server during the upgrade window", caused by predictable, web-accessible staging paths used during full-package core upgrades. Anything running WordPress core on an internet-facing host is in scope. What fixes it: the core upgrade applied as the vendor instructs, with leftover staging paths closed off — and the required action carries a due date of 2026-11-06.

What the TOCTOU in WordPress core actually means

It is a race between a check and a use, not a missing permission check, and that difference decides how you respond.

In a TOCTOU bug the code verifies something about a file or a path, then acts on it later. The attacker changes the thing in between. CISA pins the trigger to "predictable, web-accessible staging paths used during full-package core upgrades", which means the upgrade process leaves files somewhere an unauthenticated visitor can guess and fetch over HTTP. No login, no plugin, no admin session required. The window is short, but it is not random — it opens every time a full-package upgrade runs, so a site that upgrades on a schedule has a scheduled exposure.

Am I affected if I run WordPress?

You are exposed if a full-package core upgrade can run on an internet-facing host, or if staging directories from an earlier upgrade are still reachable over the web.

The CISA entry does not specify which core versions are affected, and the known ransomware campaign use field reads Unknown, so there is no victim list to check yourself against. What you can check is exposure: which hosts serve WordPress directly to the internet, who controls their upgrades, and whether anyone ever cleaned up the staging directories afterwards. For organisations with sites spread across shared hosting, agency accounts and a couple of forgotten subdomains, an architecture review of what is genuinely internet-facing is usually faster than a version audit. CISA's framing puts the burden on asset owners: stakeholders are responsible for evaluating each asset's internet exposure.

The next 24 hours: patch, verify, watch

Apply the core upgrade through the vendor's documented process, confirm the version actually serving traffic from outside your network, then watch for 48 hours.

• Upgrade core the way the vendor documents it. Do not hand-copy files into a staging directory to move faster — that recreates the predictable-path condition CISA describes.
• Close off staging directories left over from previous full-package upgrades: delete them, or block web access at the server, reverse proxy or CDN.
• Put the upgrade itself behind IP allowlisting, a VPN, or WP-CLI over SSH, so the upgrade window is not reachable from the open internet.
• Verify from outside. Hit the site through its real DNS name, behind the load balancer and CDN, and compare what is serving against what you think you deployed. Checking the box you just patched tells you nothing about the host beside it.
• Record per-host before and after state with timestamps and the name of whoever ran it, so you can answer "were we inside a window" during an incident review.
• If you cannot mitigate, CISA's required action is to discontinue use of the product.

CISA ties the timeline to BOD 26-04. That directive binds US federal agencies, not an Indian SMB, but 2026-11-06 is still a sensible internal deadline to adopt. If you run your own machines, remember that server configuration choices made in a hurry tend to outlive the incident that prompted them.

What to watch in the logs afterwards

Watch for unauthenticated requests to upgrade and staging paths, and for new files appearing in directories that should be static.

In web server access logs, filter for requests to paths containing upgrade or staging style strings from clients with no session, especially in the hours either side of an upgrade. On disk, a hash baseline over the web root and wp-content will catch PHP files that appeared where they do not belong. Outbound connections from the web host to unfamiliar addresses deserve an alert too. CISA's required action references its "Forensics Triage Requirements" for the formal version of this; for a private company the practical minimum is retaining enough log history to reconstruct the window, and knowing who to call at 11pm.

What AI-assisted review changes about a bug class like this

AI does not make a race condition visible in a diff, but it makes the slow review that catches one cheap enough to actually run.

TOCTOU bugs live in ordering — check here, use there — and a model reading a single function will usually miss them. What helps is walking the entire upgrade path with one specific question: at each step, what is on disk, at what path, and who can reach it over HTTP? That is a review most teams skip because it costs half a day. The same applies on the response side: drafting the log queries, writing the outside-in verification script, turning a CISA description into a checklist you can run against your own internal tools. The gain is not that AI writes safer upgrade code. It is that someone finally reads the upgrade path. To be clear, the advisory does not say who found this bug, and nothing here should be read as a claim about that.

Where to start

If you run WordPress anywhere customer-facing, the order is short: close staging paths today, upgrade core and verify from outside, then keep logs long enough to answer questions next week. Most of this work is unglamorous infrastructure hygiene rather than code — our web platform work is where it usually lands, and we are happy to compare notes on your internet-facing inventory.