Image vulnerability, severity high
WordPress Core TOCTOU race condition (CVE-2026-119977) exploited during upgrades, added to CISA KEV
Published
CISA added a WordPress Core flaw, CVE-2026-119977 (CVSS 8.1), to its Known Exploited Vulnerabilities catalog after seeing active exploitation. The bug is a time-of-check time-of-use race condition that could be exploited to achieve arbitrary code execution, and the title says it is abused during software upgrades. The article excerpt does not list affected or fixed versions.
What's affected
- wordpress (container image)every version
What to do
- Update WordPress core to the latest patched release
- Check CISA KEV and the WordPress security advisory for affected and fixed versions
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident wordpress-core-toctou-rce-2026-11References
Notice wordpress-core-toctou-rce-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.