Attackers Exploit the WordPress Core TOCTOU Flaw During Upgrades

On November 3, 2026, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog: a TOCTOU race condition in WordPress Core allows remote code execution during the upgrade window. The 7.1.4 fix shipped October 28 — apply it and audit your wp-content/upgrade logs.