Most WordPress security headlines are about plugins, that sprawling ecosystem where somebody's abandoned slider from 2017 lives forever. This one is different. The bug CISA just flagged sits in WordPress core, and specifically in the update process, which is a bit like finding the leak in the fire extinguisher.
A Race Condition Makes the KEV List
On November 3, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog, describing it as a "WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability." CISA only adds bugs to KEV when there's evidence of active exploitation, so this isn't a lab curiosity.
Public details are still thin. CISA's alert lists no affected versions or severity score, and the one CVSS figure in circulation (8.1, from a security news outlet) comes without a cited source. The closest match from WordPress itself is the WordPress 7.1.4 security release on October 28, which credits a fix for "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window." WordPress hasn't publicly tied that note to the CVE number, so treat the link as likely rather than confirmed.
Getting Robbed in the Queue for New Locks
A TOCTOU bug is a timing problem. Software checks something, acts on it a moment later, and an attacker who can change things in that gap gets to slip in their own version. When the gap opens during an upgrade, the routine you run to stay safe becomes the moment you're exposed, which is about as rude as security bugs get.
The practical move is to get to the latest release and verify it rather than assume. WordPress says sites with automatic background updates will start updating on their own, but a lot of business sites have auto-updates switched off because of a fragile theme or plugin stack. The 7.1.4 post also says backports to older branches are "in progress," so anyone on an older line should keep watching for their release. While you're in there, check file integrity and look through your logs for odd activity around past update times.
Core bugs are rare, which is why they deserve your attention when one does show up. This one is worth fifteen minutes today.
If this has you rethinking how your team handles patch windows, update pipelines and third-party code, our free developer security checklist is a practical place to start.
Source: CISA