Security Resilience

CVE-2026-119977

Race Condition in Wordpress 4.7 – 4.7.39

CISA KEVActive ExploitationEUVD ExploitedRace Condition
Published
31 October 2026
Modified
04 November 2026
KEV Added
03 November 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.010 64th percentile
Risk Priority 86 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-119977 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Wordpress. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 36% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during…

more

the upgrade window.

CWE(s)
CWE-367
KEV Date Added
03 November 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1553.001 Gatekeeper Bypass Defense Impairment
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.
attack.mitre.org →
T1564.010 Process Argument Spoofing Stealth
Adversaries may attempt to hide process command-line arguments by overwriting process memory.
attack.mitre.org →
T1176 Software Extensions Persistence
Adversaries may abuse software extensions to establish persistent access to victim systems.
attack.mitre.org →
T1176.001 Browser Extensions Persistence
Adversaries may abuse internet browser extensions to establish persistent access to victim systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-34354Shared CWE-367
CVE-2024-5803Shared CWE-367
CVE-2025-47407Shared CWE-367
CVE-2025-54271Shared CWE-367
CVE-2026-68488Shared CWE-367
CVE-2026-16819Shared CWE-367
CVE-2026-87517Shared CWE-367
CVE-2026-79057Shared CWE-367
CVE-2026-53838Shared CWE-367
CVE-2026-24071Shared CWE-367

Affected Assets

wordpress
wordpress
4.7 — 4.7.39 · 4.8 — 4.8.34 · 4.9 — 4.9.35

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

AC-25 Reference Monitor partial match

A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.

AC-3 Access Enforcement partial match

Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.28 Secure coding partial match
prevents

A.8.28 mandates secure coding practices (threat modelling, secure coding standards, peer review, test-driven development) that can prevent some TOCTOU instances by mandating atomic operations and file locking, but the clause governs a fallible human practice and TOCTOU is notoriously hard to catch in code review, leaving a nameable remainder of instances that slip through.

A.8.8 Management of technical vulnerabilities partial match
finds

A.8.8's reach is DISCLOSURE — it sees only instances carrying a vendor-published flaw. TOCTOU does surface as CVEs (five observed examples in the CWE entry), so the weakness is not invisible to the clause, but the disclosed share is a minority: most CWE-367 instances live in first-party code that never receives a CVE, and A.8.8's scanning/inventory programme has no view of those.

References