What is CVE-2026-119977 in WordPress Core?
CVE-2026-119977 is a critical time-of-check time-of-use (TOCTOU) race condition vulnerability affecting WordPress Core security advisory reference. This flaw stems from predictable, web-accessible staging paths utilized during full-package core upgrades.
With a CVSS score of 8.1, the security bug allows unauthenticated malicious actors to execute arbitrary code directly on the server kernel Bluetooth reference during the active upgrade window. The vulnerability has been officially added to CISA's Known Exploited Vulnerabilities catalog.
Who is affected by this TOCTOU race condition?
Any self-hosted WordPress site performing full-package core upgrades without proper file permission hardening or immediate patching is directly vulnerable. While analyzing OpenAirInterface buffer overflow network risks highlights different components, web platforms face immediate threats here.
Because the staging paths are web-accessible and predictable, remote attackers do not require any prior authentication or administrative privileges to attempt exploitation during the vulnerable timeframe.
How can I protect my server?
Mitigating this active threat requires strict adherence to vendor instructions and urgent patching guidelines to secure the staging directory during updates.
Follow these steps to secure your environment:
1. Monitor official WordPress release channels and update core packages immediately.
2. Ensure strict permission controls on web server staging directories to prevent unauthorized file access during updates.