WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

A critical time-of-check time-of-use (TOCTOU) race condition vulnerability has been identified in WordPress Core affecting versions 4.7.0 through 7.1.3. The flaw allows unauthenticated attackers to execute arbitrary code on the server by exploiting predictable, web-accessible staging paths used during full-package core upgrades. The attack window exists during the upgrade process, making it a significant risk for sites undergoing updates. CISA has flagged this vulnerability under BOD 26-04, requiring prioritized patching. WordPress has released version 7.1.4 to address the issue. Organizations are urged to update immediately and conduct forensic triage per CISA implementation guidance. The vulnerability has been assigned CVE-2026-119977 and is documented in the NVD. Wordfence has also published threat intelligence details on the exploit mechanism.