CVE-2026-119977: WordPress Core RCE via TOCTOU Race Condition

Overview

CVE-2026-119977 is a high-severity Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability affecting WordPress Core. It allows unauthenticated attackers to execute arbitrary code on the server. This threat is particularly critical as it leverages the legitimate core upgrade process, making affected WordPress installations vulnerable during their update windows.

Technical Analysis

WordPress Core versions 4.7 through 7.1.3 are vulnerable to Remote Code Execution (RCE) due to a TOCTOU race condition (CWE-367). The vulnerability arises from the use of predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can exploit this window by racing the legitimate upgrade process, likely by injecting malicious code into these temporary staging paths before they are fully processed or used by the system. The CVSS 3.1 score for this vulnerability is 8.1 (High), with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

• Affected Versions: WordPress Core versions 4.7 through 7.1.3.
• Attack Vector: Unauthenticated network access (AV:N).
• Prerequisites: The target WordPress instance must be undergoing a full-package core upgrade.
• Exploitation: Attackers exploit a race condition during the upgrade process, leveraging predictable, web-accessible staging paths to introduce malicious code.

Detection

Detecting exploitation of CVE-2026-119977 primarily involves monitoring for anomalous activity during or immediately after WordPress core upgrades.

• Web Server Logs: Monitor for unusual or unexpected requests to wp-admin or temporary upgrade directories (e.g., wp-content/upgrade/) that do not align with legitimate upgrade traffic patterns.
• Process Monitoring: Look for the web server process (e.g., httpd, nginx, php-fpm, w3wp.exe) spawning unusual child processes such as cmd.exe, powershell.exe, sh, bash, python, or perl outside of expected administrative tasks.
• File Integrity Monitoring (FIM): Monitor for unexpected file creations or modifications in WordPress core directories (wp-admin, wp-includes, wp-content) during or immediately following an upgrade, especially for executable file types (.php, .pl, .py, .sh).
• Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual external IP addresses or domains, which could indicate a successful webshell or backdoor.

Sigma Detection Rules

Web Server Process Spawning Suspicious Child Process (Windows)

title: Web Server Process Spawning Suspicious Child Process (Windows)
id: 5f9e2d1c-8b7a-4c3e-9e7f-0d2a1b3c4e5f
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Windows.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\w3wp.exe'
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-cgi.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: high

Web Server Process Spawning Suspicious Child Process (Linux)

title: Web Server Process Spawning Suspicious Child Process (Linux)
id: 6a7b8c9d-0e1f-2a3b-4c5d-6e7f8a9b0c1d
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Linux.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    process.parent.name:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
    process.name:
      - 'sh'
      - 'bash'
      - 'python'
      - 'perl'
      - 'php'
      - 'nc'
      - 'ncat'
      - 'wget'
      - 'curl'
  condition: selection
level: high

Mitigations

1. Patch Immediately: Upgrade all WordPress installations to version 7.1.4 or later. This is the most critical mitigation.
2. Restrict Access During Upgrades: If possible, temporarily restrict network access to the wp-admin directory or the entire WordPress site during core upgrade windows to minimize the attack surface.
3. Implement Strong File Permissions: Ensure strict file permissions are enforced on WordPress directories, especially wp-content and wp-admin, to prevent unauthorized file writes.
4. Deploy a Web Application Firewall (WAF): A WAF can help detect and block suspicious requests targeting WordPress upgrade paths or common webshell patterns.
5. Regular Backups: Maintain regular, tested backups of your WordPress site and database to facilitate recovery in case of compromise.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-119977
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
• https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
• https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
• https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
• https://wordpress.org/news/2026/10/wordpress-7-1-4/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
• https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1059 — Command and Scripting Interpreter