WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

What is the Vulnerability?

CVE-2026-119977 is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in WordPress Core that affects the full-package core upgrade process. During an update, WordPress stages upgrade files in a predictable, web-accessible directory under `wp-content/upgrade/`. These files include the `setup-config.php` installer.

An unauthenticated remote attacker who accesses the staged installer during the upgrade window can exploit this condition to execute arbitrary code on the server. According to published technical analyses, the attacker can supply their own database configuration details, causing the upgrade process to overwrite the site’s existing `wp-config.php` file with the attacker’s configuration. This can allow the attacker to create an administrator account and execute arbitrary PHP code.

The vulnerability has a CVSS score of 8.1. Exploitation requires no authentication or user interaction but is timing-dependent, as the attack is only possible while a vulnerable site is actively performing a full-package core update.

Although the exploitation window is limited to the duration of the update process, the exposure is significant because WordPress sites are widely deployed and internet-facing. Organizations running affected versions should prioritize applying the security update and verify that no unauthorized changes or administrator accounts were introduced during potentially vulnerable upgrade windows.

What is the recommended Mitigation?

Fixed versions: WordPress released 7.1.4 on October 28, 2026, with fixes for each supported branch.

1. Block web access to wp-content/upgrade/ before updating. The first update to a fixed release still runs through the vulnerable updater. Researchers recommend denying the path at the web server (Nginx or Apache) and confirming a 403 response before starting the update.

2. Apply the security update. Upgrade to WordPress 7.1.4, or to the fixed release for your branch, then verify the installed version.

3. Clean up staging files. Delete leftover files under wp-content/upgrade/ that the updater did not remove.

4. Monitor for exploitation attempts. Review web server logs for requests to PHP files under wp-content/upgrade/, especially setup-config.php.

5. Review for compromise indicators. Check wp-config.php for unexpected changes, such as a different database host. Look for unfamiliar administrator accounts, unknown plugins, and unrecognized PHP files.

6. If compromise is suspected, restore a known-good configuration, rotate database and administrator credentials, and engage incident response.

What FortiGuard Coverage is available?

FortiGuard Labs continues to monitor exploitation attempts targeting WordPress Core and the associated attack techniques.

FortiGuard customers should use multiple layers of defense to help identify and mitigate suspicious activity associated with the exploitation of CVE-2026-119977:

– FortiGate Intrusion Prevention System (IPS): Provides network-level intrusion prevention and detection against known exploitation attempts targeting WordPress Core vulnerabilities. https://www.fortiguard.com/encyclopedia/ips/62806

– FortiEDR: Behavioral detection capabilities can help identify suspicious PHP execution, command execution, and other post-exploitation activity on monitored endpoints.

– FortiGuard Incident Response: Organizations suspecting compromise can engage FortiGuard Incident Response for investigation, containment, and remediation.