WordPress Core race-condition flaw exploited in wild
A TOCTOU race condition in WordPress Core upgrade staging directories allows unauthenticated RCE and is actively exploited, now in CISA's KEV catalog.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-119977 as exploited in the wild.
NCSC-NL published an advisory for CVE-2026-119977, a Time-of-Check Time-of-Use (TOCTOU) race condition affecting WordPress Core versions 4.7 through 7.1.3. The vulnerability arises during full WordPress Core upgrades, when staging directories become briefly accessible over the web. An unauthenticated remote attacker who successfully times exploitation within this narrow upgrade window can achieve remote code execution on the server.
CISA confirmed active exploitation and added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on 3 November 2026. The flaw carries a CVSS v3 score of 8.1. WordPress has released updates to remediate the issue. Given the extremely broad range of affected versions (spanning nearly a decade of releases) and confirmed in-the-wild exploitation, defenders running self-hosted WordPress instances should prioritize patching to the fixed version and review upgrade logs/timing for anomalous activity during core update windows.
Mentioned in this report
Detection guidance
WordPress Upgrade Staging Directory PHP File Requested Over Web
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Successful web request for a PHP file under wp-content/upgrade/, the WordPress core upgrade staging area that should not be web-served, consistent with exploiting the upgrade race-condition window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WordPress Upgrade Staging Directory PHP File Requested Over Web
description: Detects successful HTTP requests for PHP files under the WordPress wp-content/upgrade
staging directory. The CVE-2026-119977 TOCTOU flaw exposes staging directories during
core upgrades, so 200 responses for scripts here suggest exploitation attempts.
Confirm against the timing of legitimate core upgrades.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /wp-content/upgrade/
cs-uri-stem|endswith: .php
sc-status: 200
condition: selection
falsepositives:
- Administrators or plugins deliberately testing upgrade directory exposure during
a core update
- Vulnerability scanners run by the owner that receive 200 responses
level: medium
id: a2f7355a-7c12-533f-9da5-82fa11f6fa32
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0466.html
Linux Web Server Process Spawning Shell With Download or Reverse Shell Commands
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Web server or PHP worker process spawning a shell that runs download, reverse-shell or decoding commands, typical of post-exploitation RCE on a public-facing WordPress host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Web Server Process Spawning Shell With Download or Reverse Shell Commands
description: Detects web server or PHP handler processes (apache, httpd, nginx, php-fpm,
php-cgi) spawning a shell whose command line downloads payloads, opens a reverse
shell or decodes base64. This is the likely post-exploitation step after RCE through
a public-facing WordPress flaw such as CVE-2026-119977.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /php-fpm
- /php-cgi
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'curl '
- 'wget '
- /dev/tcp/
- nc -e
- base64 -d
- bash -i
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web applications or plugins that legitimately shell out to curl or wget for updates
or health checks
- Hosting control panels running scripted tasks under the web server user
level: medium
id: e12e087b-208d-589b-aec0-89ce1e476d99
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0466.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0466.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs