WordPress Core flaw allows code execution during upgrades
The National Vulnerability Database said WordPress Core has a time-of-check time-of-use race condition that could let an unauthenticated attacker execute code on the server during the upgrade window. The entry identifies the flaw as CVE-2026-119977.
According to the NVD, the issue is linked to predictable staging paths that remain accessible over the web during full-package core upgrades. The evidence does not provide an affected version range or report exploitation in the wild.
The NVD said operators should apply mitigations according to WordPress vendor instructions and follow applicable CISA BOD 26-04 patching guidance. It set November 6, 2026, as the due date and said organizations should discontinue use of the product if mitigations are unavailable.