[CVE-2026-119977] WordPress WordPress Core — WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

What happened?

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

Key details

• Linux Kernel has a missing variable initialization vulnerability.
• The flaw allows unintended modification of page-cache-backed data.
• Failure to preserve shared-fragment marker during socket buffer coalescing causes the issue.
• ESP input processing decrypts shared fragments in place as a result.
• This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619.
• Chaining can implant PHP webshells and run commands as root.

Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.